{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.5.0"}],"component":"fast-filesystem-mcp","cve_ids":["CVE-2026-5327"],"ecosystem":"npm","epss":0.01243,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-5226-3rvg-hp4x","id":"tcs_01M5KF22WKG969HA88X41GYVDD","modified_at":"2026-04-04T05:56:28.888620Z","published_at":"2026-04-02T12:31:05Z","references":["https://osv.dev/vulnerability/GHSA-5226-3rvg-hp4x","https://nvd.nist.gov/vuln/detail/CVE-2026-5327","https://github.com/efforthye/fast-filesystem-mcp/issues/15","https://github.com/efforthye/fast-filesystem-mcp","https://github.com/user-attachments/files/25822878/fast-filesystem-mcp_bug.pdf","https://vuldb.com/submit/780776","https://vuldb.com/vuln/354658","https://vuldb.com/vuln/354658/cti"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-5226-3rvg-hp4x","url":"https://osv.dev/vulnerability/GHSA-5226-3rvg-hp4x"}],"summary":"fast-filesystem-mcp is vulnerable to command injection through handleGetDiskUsage function"}