CVE-2026-25546: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25546 is an OS command injection vulnerability in godot-mcp, a Model Context Protocol (MCP) server for interacting with the Godot game engine. The flaw exists in all versions of the npm package @coding-solo/godot-mcp prior to 0.1.1, and was discovered by researcher TianYu-0829, reported via GitHub Issue #64 on January 19, 2026, and publicly disclosed on February 4, 2026 (GitHub Advisory). The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In the vulnerable executeOperation function within src/index.ts, user-controlled input — specifically the projectPath parameter — is interpolated directly into a shell command string that is then passed to Node.js's exec() (via execAsync), which spawns a shell to interpret the command (GitHub Issue #64). Because no sanitization or escaping is applied, an attacker can inject shell metacharacters such as $(command), &&, |, or > into the projectPath value to cause arbitrary command execution. This pattern affects all tools that accept projectPath, including create_scene, add_node, and load_sprite (GitHub Advisory). A realistic attack vector involves a victim opening a malicious .godot project file whose path contains injected shell commands, or an attacker leveraging indirect prompt injection through an AI assistant connected to the MCP server (GitHub Issue #64).

Successful exploitation results in arbitrary OS command execution with the privileges of the MCP server process, yielding high impact across confidentiality, integrity, and availability. An attacker can read sensitive files, modify or delete data, install backdoors, or disrupt service on the host running the MCP server. Because the MCP server may be integrated with AI coding assistants operating in developer environments, exploitation could expose source code, credentials, and other sensitive development artifacts (GitHub Advisory, GitHub Issue #64).

A public proof-of-concept exploit is available on GitHub (PoC Exploit), published around March 2, 2026. There is no confirmed evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.037% (11th percentile), indicating a currently low but non-negligible probability of exploitation (GitHub Advisory). Exploitation requires local access and user interaction (e.g., a victim opening a malicious project file or an AI assistant being manipulated via prompt injection), but no privileges are required (GitHub Advisory).

1. Craft a malicious project path: Create a directory path containing shell metacharacters, e.g., /home/user/Research/$(id>/tmp/pwned), and place a project.godot file within it to satisfy the server's project validation check.
2. Distribute or position the malicious path: Either host the malicious .godot project for a victim to download, or use indirect prompt injection to instruct an AI assistant connected to the MCP server to use the crafted path.
3. Trigger a vulnerable tool call: Using MCP Inspector or an AI assistant, invoke any tool that accepts projectPath (e.g., create_scene, add_node, load_sprite) with the malicious path as the argument. Example request:

{
  "method": "tools/call",
  "params": {
    "name": "create_scene",
    "arguments": {
      "projectPath": "/home/user/Research/$(id>/tmp/pwned)",
      "scenePath": "/home/user/Research",
      "rootNodeType": "Node2D"
    }
  }
}

4. Command executes: The executeOperation function interpolates the projectPath into a shell command string passed to exec(), causing the shell to evaluate $(id>/tmp/pwned) and write the output of id to /tmp/pwned.
5. Achieve arbitrary code execution: Replace the id payload with any desired command (e.g., a reverse shell) to gain full control of the MCP server process (GitHub Issue #64, GitHub Advisory).

• Logs: MCP server debug logs showing command strings with shell metacharacters (e.g., $(), &&, |, >) embedded in the projectPath argument; unexpected output files created in /tmp or other writable directories.
• File System: Unexpected files created in /tmp or world-writable directories (e.g., output of injected commands); new scripts, cron jobs, or SSH authorized keys added by the MCP server process user.
• Process: Unusual child processes spawned by the Node.js MCP server process (e.g., bash, sh, curl, wget, python, nc) visible in process trees; unexpected network connections originating from the MCP server process.
• Network: Outbound connections to unknown external IPs or domains initiated by the MCP server process, particularly on non-standard ports (indicative of reverse shell activity).

The vulnerability is fixed in godot-mcp version 0.1.1, which replaces all uses of exec() with execFile() — passing arguments as an array rather than a shell-interpreted string, eliminating shell metacharacter injection (GitHub PR #67, Patch Commit). There are no official workarounds; the vendor advisory explicitly states users should upgrade immediately (GitHub Advisory). As a defense-in-depth measure, restrict the MCP server to trusted local environments, avoid exposing it to untrusted input sources, and validate that projectPath values correspond to known, trusted directories before processing.

The vulnerability was discussed in the context of a broader pattern of command injection flaws in MCP server implementations, with community commentary noting that multiple MCP CVEs have been disclosed within a short timeframe due to the same root cause — unsanitized user input passed to shell execution functions (dev.to/kai_security_ai, Telegra.ph). The fix author (wcole3) noted that AI agents tested during remediation were "quite good at recognizing" the potential for shell injection, but cautioned against relying on that behavior as a security control (GitHub PR #67). The disclosure was covered by The Hacker Wire and shared on Mastodon and Bluesky.