CVE-2026-25546
1 advisory.
npm/@coding-solo/godot-mcp CVE-2026-25546: high 7.8, EPSS 1.01%
godot-mcp has Command Injection via unsanitized projectPath
Action: Upgrade @coding-solo/godot-mcp to 0.1.1 or later.
npm i @coding-solo/godot-mcp@0.1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.1.1 | - |
Fixed versions
| 0.1.1 |
Sources
- osv: GHSA-8jx2-rhfh-q928
- https://github.com/Coding-Solo/godot-mcp/security/advisories/GHSA-8jx2-rhfh-q928
- https://nvd.nist.gov/vuln/detail/CVE-2026-25546
- https://github.com/Coding-Solo/godot-mcp/issues/64
- https://github.com/Coding-Solo/godot-mcp/pull/67
- https://github.com/Coding-Solo/godot-mcp/commit/21c785d923cfdb471ea60323c13807d62dfecc5a
- https://github.com/Coding-Solo/godot-mcp
CVE-2026-25546 · published · modified · JSON