{"id":"CVE-2026-113378","kind":"vulnerability","aliases":["CVE-2026-113378"],"related":[],"title":"mcp-ripgrep: fileType argument allows OS command injection on local machine","description":"A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The real existence of this vulnerability is still doubted at the moment. The code's own escapeShellArg on sibling arguments (skipped only for fileType) indicates that this is a CWE-78 oversight, not a documented design. The project maintainer cites the documentation: \"This MCP server executes shell commands using the ripgrep tool. While efforts have been made to safely escape arguments, use caution when providing input, as it runs commands on your machine.\"","summary":"The mcp-ripgrep MCP server (up to 0.4.0) passes the fileType argument to a shell command without the escaping applied to its other arguments. An attacker who can supply that argument can run arbitrary OS commands with the privileges of the process running the server.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","claude-code","developer-machines","mcp","mcp-ripgrep"],"not_affected_if":["filetype-input-trusted","package-not-installed"],"how_to_check":"- Check the installed version of mcp-ripgrep (for example in `package.json` or the `npx` cache) and see whether it is `0.4.0` or older.\n- Look in `src/index.ts` for the fileType argument being concatenated into a shell command without `escapeShellArg`.\n- Check whether any MCP client config (`claude_desktop_config.json`, `.mcp.json`, or similar) starts mcp-ripgrep.","fix":"- Upgrade or remove mcp-ripgrep; no fixed version is stated in the sources (unknown).\n- Until a fix exists, do not pass untrusted input to the fileType argument.","status":"open","published_at":"2026-10-20T10:17:05+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:54+00:00","updated_at":"2026-10-25T04:24:54+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-25T04:24:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade or remove mcp-ripgrep; no fixed version is stated in the sources (unknown).\n- Until a fix exists, do not pass untrusted input to the fileType argument.","reach":"local","title":"mcp-ripgrep: fileType argument allows OS command injection on local machine","impact":"high","summary":"The mcp-ripgrep MCP server (up to 0.4.0) passes the fileType argument to a shell command without the escaping applied to its other arguments. An attacker who can supply that argument can run arbitrary OS commands with the privileges of the process running the server.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","mcp-ripgrep","claude-code","developer-machines"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Arbitrary OS commands run with the MCP server process privileges","analyst_note":"Sources doubt the vulnerability is real and give no fixed version; confirm against the upstream repo and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113378.","how_to_check":"- Check the installed version of mcp-ripgrep (for example in `package.json` or the `npx` cache) and see whether it is `0.4.0` or older.\n- Look in `src/index.ts` for the fileType argument being concatenated into a shell command without `escapeShellArg`.\n- Check whether any MCP client config (`claude_desktop_config.json`, `.mcp.json`, or similar) starts mcp-ripgrep.","needs_analyst":true,"not_affected_if":["package-not-installed","fileType-input-trusted"],"who_is_affected":"Teams that run the mcp-ripgrep MCP server, typically wired into a coding agent or chat client on a developer machine. The attack path is described as local, and the maintainer's own docs say the server runs shell commands and to use caution with input. Teams not running this package can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":3466,"output_tokens":706,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113378':15A,18A '-2026':14A,17A '-78':168C '0.4.0':40B,91C 'advanc':104C 'affect':92C 'ai':20B 'ai-tool':19B 'allow':6A 'appli':52B 'approach':123C 'arbitrari':66B 'argument':5A,44B,56B,63B,111C,157C,198C 'attack':58B,119C,137C 'caution':200C 'cite':177C 'claud':23B 'claude-cod':22B 'code':24B,151C 'command':8A,48B,68B,116C,185C,207C 'compon':103C 'cve':13A,16A 'cwe':167C 'design':173C 'develop':26B 'developer-machin':25B 'discov':83C 'document':172C,179C 'doubt':146C 'effort':191C 'escap':51B,197C 'escapeshellarg':154C 'execut':183C 'exist':140C 'exploit':125C 'file':99C 'filetyp':4A,43B,112C,161C 'flaw':80C 'function':96C 'indic':162C 'inject':9A,117C 'input':203C 'local':11A,122C 'machin':12A,27B,210C 'made':194C 'maintain':176C 'manipul':108C 'may':133C 'mcollina':85C 'mcp':2A,28B,30B,34B,36B,87C,181C 'mcp-ripgrep':1A,29B,33B,86C 'moment':149C 'os':7A,67B,115C 'oversight':169C 'pass':41B 'privileg':71B 'process':74B 'project':175C 'provid':202C 'public':131C 'real':139C 'releas':128C 'requir':120C 'result':113C 'ripgrep':3A,31B,35B,88C,188C 'run':65B,75B,206C 'safe':196C 'search':105C 'secur':79C 'server':37B,77B,182C 'shell':47B,184C 'sibl':156C 'skip':158C 'src/index.ts':100C 'still':145C 'suppli':61B 'tool':21B,106C,189C 'unknown':95C 'use':135C,186C,199C 'vulner':143C 'without':49B","nicknames":[],"mitigations":[],"who_affected":"Teams that run the mcp-ripgrep MCP server, typically wired into a coding agent or chat client on a developer machine. The attack path is described as local, and the maintainer's own docs say the server runs shell commands and to use caution with input. Teams not running this package can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113378","severity":null,"published_at":"2026-10-20T10:17:05+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}