https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:30:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-256672 EUVD-2026-256672 https://cve.radiocsirt.org/vuln/euvd-2026-256672 https://cve.radiocsirt.org/vuln/fkie_cve-2025-11489 <p>A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performed from a local environment. The attack&#39;s complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The vendor explains: &#34;Our restriction features are designed as guardrails for LLMs to help them stay closer to what users want, rather than hardened security boundaries. (...) For users where security is a top priority, we continue to recommend using Desktop Commander with Docker, which provides actual isolation. (...) We&#39;ll keep this issue open for future consideration if we receive more user demand for improved restrictions.&#34; This vulnerability only affects products that are no longer supported by the maintainer.</p> <p>A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performed from a local environment. The attack&#39;s complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The vendor explains: &#34;Our restriction features are designed as guardrails for LLMs to help them stay closer to what users want, rather than hardened security boundaries. (...) For users where security is a top priority, we continue to recommend using Desktop Commander with Docker, which provides actual isolation. (...) We&#39;ll keep this issue open for future consideration if we receive more user demand for improved restrictions.&#34; This vulnerability only affects products that are no longer supported by the maintainer.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-11489 https://cve.radiocsirt.org/vuln/ghsa-2jf9-5hf7-r448 <p>A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performed from a local environment. The attack&#39;s complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The vendor explains: &#34;Our restriction features are designed as guardrails for LLMs to help them stay closer to what users want, rather than hardened security boundaries. (...) For users where security is a top priority, we continue to recommend using Desktop Commander with Docker, which provides actual isolation. (...) We&#39;ll keep this issue open for future consideration if we receive more user demand for improved restrictions.&#34; This vulnerability only affects products that are no longer supported by the maintainer.</p> <p>A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performed from a local environment. The attack&#39;s complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The vendor explains: &#34;Our restriction features are designed as guardrails for LLMs to help them stay closer to what users want, rather than hardened security boundaries. (...) For users where security is a top priority, we continue to recommend using Desktop Commander with Docker, which provides actual isolation. (...) We&#39;ll keep this issue open for future consideration if we receive more user demand for improved restrictions.&#34; This vulnerability only affects products that are no longer supported by the maintainer.</p> https://cve.radiocsirt.org/vuln/ghsa-2jf9-5hf7-r448