CVE-2026-19044

MEDIUM

CVE: CVE-2026-19044 - A flaw has been found in LeeSinLiang godot-mcp 0Sign in to save

CVSS

5.3

CVSS v3.1

EPSS

0.7%

Exploit Prediction Score

Published

August 6, 2026

Exploitability

EPSS probability 0.7%

Description

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.

Weaknesses

CWE-74CWE-77

Affected Packages

No package data available.

Aliases

CVE-2026-19044

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/LeeSinLiang/godot-mcp/
https://github.com/LeeSinLiang/godot-mcp/issues/1
https://vuldb.com/cve/CVE-2026-19044
https://vuldb.com/submit/863832
https://vuldb.com/vuln/386486
https://vuldb.com/vuln/386486/cti