{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.4.12"}],"component":"@profullstack/mcp-server","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-v6wj-c83f-v46x","id":"tcs_01M5KGB32FMA5MDBNQTTVNF7W3","modified_at":"2026-05-09T00:49:08.290385Z","published_at":"2026-05-09T00:42:12Z","references":["https://osv.dev/vulnerability/GHSA-v6wj-c83f-v46x","https://github.com/profullstack/mcp-server/security/advisories/GHSA-v6wj-c83f-v46x","https://github.com/profullstack/mcp-server"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-v6wj-c83f-v46x","url":"https://osv.dev/vulnerability/GHSA-v6wj-c83f-v46x"}],"summary":"@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module"}