vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-5603

elgentos magento2-dev-mcp index.ts executeMagerun2Command os command injection

MEDIUM
5.3
CVSS Score
Published: April 5, 2026 at 10:30 PM UTC
Updated: July 24, 2026 at 08:20 PM UTC
1 product affected across 1 vendorMAGENTO2 Dev Mcp

Using magento2-dev-mcp by elgentos?

Get instant alerts when new vulnerabilities affect magento2-dev-mcp - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.3
Exploit prediction
EPSS 0.9%
SSVC
PoC

Description

A vulnerability was identified in elgentos magento2-dev-mcp up to 1.0.2. The affected element is the function executeMagerun2Command of the file src/index.ts. Such manipulation leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used. The name of the patch is aa1ffcc0aea1b212c69787391783af27df15ae9d. A patch should be applied to remediate this issue.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (8)

Product
Source: [email protected]
https://github.com/elgentos/magento2-dev-mcp/
Patch
Source: [email protected]
https://github.com/elgentos/magento2-dev-mcp/commit/aa1ffcc0aea1b212c69787391783af27df15ae9d
Issue Tracking
Source: [email protected]
https://github.com/elgentos/magento2-dev-mcp/issues/4
Issue TrackingPatch
Source: [email protected]
https://github.com/elgentos/magento2-dev-mcp/pull/5
Exploit
Source: [email protected]
https://github.com/user-attachments/files/25895777/magento2-dev-mcp_bug.pdf
Third Party Advisory
Source: [email protected]
https://vuldb.com/submit/784864
VDB EntryTechnical Description
Source: [email protected]
https://vuldb.com/vuln/355395
SignaturePermissions Required
Source: [email protected]
https://vuldb.com/vuln/355395/cti

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.3MEDIUMVulDB
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-77CWE-78

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card