{"action":"Upgrade @coding-solo/godot-mcp to 0.1.1 or later.","affected":[{"fixed":"0.1.1","introduced":"0"}],"component":"@coding-solo/godot-mcp","cve_ids":["CVE-2026-25546"],"ecosystem":"npm","epss":0.00951,"exploited":false,"fixed_versions":["0.1.1"],"ghsa_id":"GHSA-8jx2-rhfh-q928","id":"tcs_01M5KFDBP5Z06M8AJ69R7FVK7H","modified_at":"2026-02-05T00:37:12Z","published_at":"2026-02-04T20:02:32Z","references":["https://osv.dev/vulnerability/GHSA-8jx2-rhfh-q928","https://github.com/Coding-Solo/godot-mcp/security/advisories/GHSA-8jx2-rhfh-q928","https://nvd.nist.gov/vuln/detail/CVE-2026-25546","https://github.com/Coding-Solo/godot-mcp/issues/64","https://github.com/Coding-Solo/godot-mcp/pull/67","https://github.com/Coding-Solo/godot-mcp/commit/21c785d923cfdb471ea60323c13807d62dfecc5a","https://github.com/Coding-Solo/godot-mcp"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-8jx2-rhfh-q928","url":"https://osv.dev/vulnerability/GHSA-8jx2-rhfh-q928"}],"summary":"godot-mcp has Command Injection via unsanitized projectPath"}