---
id: "CVE-2026-113378"
kind: "vulnerability"
aliases: ["CVE-2026-113378"]
title: "mcp-ripgrep: fileType argument allows OS command injection on local machine"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "claude-code", "developer-machines", "mcp", "mcp-ripgrep"]
not_affected_if: ["filetype-input-trusted", "package-not-installed"]
published_at: "2026-10-20T10:17:05+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:24:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113378", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# mcp-ripgrep: fileType argument allows OS command injection on local machine

The mcp-ripgrep MCP server (up to 0.4.0) passes the fileType argument to a shell command without the escaping applied to its other arguments. An attacker who can supply that argument can run arbitrary OS commands with the privileges of the process running the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of mcp-ripgrep (for example in `package.json` or the `npx` cache) and see whether it is `0.4.0` or older.
- Look in `src/index.ts` for the fileType argument being concatenated into a shell command without `escapeShellArg`.
- Check whether any MCP client config (`claude_desktop_config.json`, `.mcp.json`, or similar) starts mcp-ripgrep.

## Fix

- Upgrade or remove mcp-ripgrep; no fixed version is stated in the sources (unknown).
- Until a fix exists, do not pass untrusted input to the fileType argument.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113378

## From the sources

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The real existence of this vulnerability is still doubted at the moment. The code's own escapeShellArg on sibling arguments (skipped only for fileType) indicates that this is a CWE-78 oversight, not a documented design. The project maintainer cites the documentation: "This MCP server executes shell commands using the ripgrep tool. While efforts have been made to safely escape arguments, use caution when providing input, as it runs commands on your machine."

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_