https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 11:20:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-252633 EUVD-2026-252633 https://cve.radiocsirt.org/vuln/euvd-2026-252633 https://cve.radiocsirt.org/vuln/fkie_cve-2025-59377 <p>feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. NOTE: this is unrelated to mcp-server-kubernetes and CVE-2025-53355.</p> <p>feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. NOTE: this is unrelated to mcp-server-kubernetes and CVE-2025-53355.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-59377 https://cve.radiocsirt.org/vuln/ghsa-4hqq-7q79-932p <p><strong>Affected:</strong> PyPI: mcp-kubernetes-server</p> <p>`feiskyer/mcp-kubernetes-server` through **0.1.11** allows **OS command injection** via the `/mcp/kubectl` endpoint. The handler constructs a shell command with user-supplied arguments and executes it with `subprocess` using `shell=True`, enabling injection through shell metacharacters (e.g., `;`, `&amp;&amp;`, `$()`), even when the server is running in **read-only** mode.</p> <p>A remote, unauthenticated attacker can execute arbitrary OS commands on the host, resulting in full compromise of confidentiality, integrity, and availability.</p> <p>This issue is **distinct from** `mcp-server-kubernetes` and from **CVE-2025-53355**.</p> <p><strong>Affected:</strong> PyPI: mcp-kubernetes-server</p> <p>`feiskyer/mcp-kubernetes-server` through **0.1.11** allows **OS command injection** via the `/mcp/kubectl` endpoint. The handler constructs a shell command with user-supplied arguments and executes it with `subprocess` using `shell=True`, enabling injection through shell metacharacters (e.g., `;`, `&amp;&amp;`, `$()`), even when the server is running in **read-only** mode.</p> <p>A remote, unauthenticated attacker can execute arbitrary OS commands on the host, resulting in full compromise of confidentiality, integrity, and availability.</p> <p>This issue is **distinct from** `mcp-server-kubernetes` and from **CVE-2025-53355**.</p> https://cve.radiocsirt.org/vuln/ghsa-4hqq-7q79-932p https://cve.radiocsirt.org/vuln/pysec-2026-409 <p><strong>Affected:</strong> PyPI: mcp-kubernetes-server</p> <p>`feiskyer/mcp-kubernetes-server` through **0.1.11** allows **OS command injection** via the `/mcp/kubectl` endpoint. The handler constructs a shell command with user-supplied arguments and executes it with `subprocess` using `shell=True`, enabling injection through shell metacharacters (e.g., `;`, `&amp;&amp;`, `$()`), even when the server is running in **read-only** mode.</p> <p>A remote, unauthenticated attacker can execute arbitrary OS commands on the host, resulting in full compromise of confidentiality, integrity, and availability.</p> <p>This issue is **distinct from** `mcp-server-kubernetes` and from **CVE-2025-53355**.</p> <p><strong>Affected:</strong> PyPI: mcp-kubernetes-server</p> <p>`feiskyer/mcp-kubernetes-server` through **0.1.11** allows **OS command injection** via the `/mcp/kubectl` endpoint. The handler constructs a shell command with user-supplied arguments and executes it with `subprocess` using `shell=True`, enabling injection through shell metacharacters (e.g., `;`, `&amp;&amp;`, `$()`), even when the server is running in **read-only** mode.</p> <p>A remote, unauthenticated attacker can execute arbitrary OS commands on the host, resulting in full compromise of confidentiality, integrity, and availability.</p> <p>This issue is **distinct from** `mcp-server-kubernetes` and from **CVE-2025-53355**.</p> https://cve.radiocsirt.org/vuln/pysec-2026-409