Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS command execution when an AI agent is induced to invoke these tools. Commit 88c77fc fixes these vulnerabilities.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Klarso Gmbh |
|
No data.
No data.
References
History
Fri, 21 Aug 2026 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Klarso Gmbh
Klarso Gmbh neo-mjs |
|
| Vendors & Products |
Klarso Gmbh
Klarso Gmbh neo-mjs |
Thu, 20 Aug 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-78 |
Thu, 20 Aug 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Thu, 20 Aug 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Thu, 20 Aug 2026 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS command execution when an AI agent is induced to invoke these tools. Commit 88c77fc fixes these vulnerabilities. | |
| Title | CVE-2026-18482 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: certcc
Published: 2026-08-20T12:36:40.567Z
Updated: 2026-08-20T19:16:46.108Z
Reserved: 2026-07-31T12:46:16.513Z
Link: CVE-2026-18482
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-20T13:16:58.560
Modified: 2026-08-20T20:17:33.800
Link: CVE-2026-18482
Redhat
No data.