{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.1.3"}],"component":"@nor2/heim-mcp","cve_ids":["CVE-2026-5602"],"ecosystem":"npm","epss":0.00909,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-wx4p-jr66-jfp9","id":"tcs_01M5KGG8W0NCXXZQ2M98BXPSFR","modified_at":"2026-04-06T18:27:07.090342Z","published_at":"2026-04-06T00:30:24Z","references":["https://osv.dev/vulnerability/GHSA-wx4p-jr66-jfp9","https://nvd.nist.gov/vuln/detail/CVE-2026-5602","https://github.com/Nor2-io/heim-mcp/issues/1","https://github.com/Nor2-io/heim-mcp/pull/2","https://github.com/Nor2-io/heim-mcp/commit/c321d8af25f77668781e6ccb43a1336f9185df37","https://github.com/Nor2-io/heim-mcp","https://github.com/user-attachments/files/25889482/heim-mcp_bug.pdf","https://vuldb.com/submit/784862","https://vuldb.com/vuln/355394","https://vuldb.com/vuln/355394/cti"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-wx4p-jr66-jfp9","url":"https://osv.dev/vulnerability/GHSA-wx4p-jr66-jfp9"}],"summary":"@nor2/heim-mcp vulnerable to command injection"}