CVE-2026-25546

CVE-2026-25546 describes a command injection vulnerability in Godot MCP, a Model Context Protocol server for the Godot game engine, affecting versions prior to 0.1.1. This flaw allows remote code execution due to the 'executeOperation' function directly passing user-controlled input, such as 'projectPath', to the 'exec()' function, which spawns a shell. An attacker could inject shell metacharacters to execute arbitrary commands with the privileges of the MCP server. The vulnerability is rated as HIGH severity (CVSS 7.8), indicating a low attack complexity and no required privileges, though user interaction is required. A successful exploit could lead to complete compromise of confidentiality, integrity, and availability of the affected system. Currently, there is no evidence of active exploitation, and no public exploit code or Metasploit/Nuclei modules are available. Community discussion and media coverage for this CVE are minimal, which is typical for the vast majority of reported vulnerabilities.