Medium severity · published Aug 6, 2026
CVE-2026-19041
MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection
6.3
CVSS
2.1%
EPSS
No
On KEV
Description
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. Upgrading to version 1.11.9 is sufficient to resolve this issue. The identifier of the patch is a40f54d4533ba6618e1749383a245900eeb024c1. The affected component should be upgraded.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
mcp-api · MissionSquad
1.11.0; 1.11.1; 1.11.2; 1.11.3; 1.11.4; 1.11.5; +3 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19041
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19041
github.com
https://github.com/MissionSquad/mcp-api/
github.com
https://github.com/MissionSquad/mcp-api/commit/a40f54d4533ba6618e1749383a245900eeb024c1
github.com
https://github.com/MissionSquad/mcp-api/issues/41
github.com
https://github.com/MissionSquad/mcp-api/pull/44
github.com
https://github.com/MissionSquad/mcp-api/releases/tag/v1.11.9
vuldb.com
https://vuldb.com/cve/CVE-2026-19041
More from mcp-api
6.3
CVE-2026-19040
MissionSquad mcp-api dcrClients.ts server-side request forgery