CVE-2026-10690

MEDIUM

wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery

Title source: cna
STIX 2.1

Description

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa. It is best practice to apply a patch to resolve this issue.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-367959 | wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery
https://vuldb.com/vuln/367959
Signature, Permissions Required signature permissions-required
VDB-367959 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/367959/cti
Third Party Advisory third-party-advisory
CVE-2026-10690 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-10690
Third Party Advisory third-party-advisory
Submit #830735 | wonderwhy-er DesktopCommanderMCP 0.2.37 Server-Side Request Forgery
https://vuldb.com/submit/830735

Scores

CVSS v3 6.3
EPSS 0.0021
EPSS Percentile 11.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (1)
wonderwhy-er/DesktopCommanderMCP 0.2.37
Published Jun 03, 2026
Tracked Since Jun 03, 2026