CVE-2026-19044

Impact

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/LeeSinLiang/godot-mcp/
• https://github.com/LeeSinLiang/godot-mcp/issues/1
• https://vuldb.com/cve/CVE-2026-19044
• https://vuldb.com/submit/863832
• https://vuldb.com/vuln/386486
• https://vuldb.com/vuln/386486/cti