CVE-2026-3680

MEDIUM

RyuzakiShinji biome-mcp-server <=1.0.0 - Command Injection

Title source: llm
STIX 2.1

Description

A security flaw has been discovered in RyuzakiShinji biome-mcp-server up to 1.0.0. Affected by this issue is some unknown functionality of the file biome-mcp-server.ts. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 335e1727147efeef011f1ff8b05dd751d8a660be. Applying a patch is the recommended action to fix this issue.

References (7)

Core 7
Core References
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.765399
Permissions Required, VDB Entry vdb-entry
https://vuldb.com/?id.349582
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.349582
Issue Tracking issue-tracking patch
https://github.com/RyuzakiShinji/biome-mcp-server/pull/1

Scores

CVSS v3 6.3
EPSS 0.0111
EPSS Percentile 61.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-77
Status published
Published Mar 07, 2026
Tracked Since Mar 08, 2026