GitHub Advisoryadvisory · npm
GHSA-5xx3-j724-wmx5 DesktopCommanderMCP is vulnerable to SSRF
LOW
Official page ↗
- Aliases
- CVE-2026-10690
- Ecosystem
- npm
- Packages
- @wonderwhy-er/desktop-commander
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-918
- Reviewed
- 2026-07-10
Affected packages
• npm @wonderwhy-er/desktop-commander: <= 0.2.37 (no fix yet)
Description
A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa. It is best practice to apply a patch to resolve this issue.
Related
Alias · CVE (1)
- CVE-2026-10690 A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. vulnerability
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-10690 advisory
- https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/410 web
- https://github.com/sorlen008/DesktopCommanderMCP/commit/53699bebba9950047bca16ac4dc8f0568f596aaa web
- https://github.com/wonderwhy-er/DesktopCommanderMCP package
- https://vuldb.com/cve/CVE-2026-10690 web
- https://vuldb.com/submit/830735 web
- https://vuldb.com/vuln/367959 web
- https://vuldb.com/vuln/367959/cti web