Riskcovery

CVE-2026-19263

INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection

State
Published
Severity
6.9 Medium
Published
Aug 8, 2026
Updated
Aug 11, 2026
Reserved
Aug 7, 2026

Read the record on cve.org

Description

A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/args results in command injection. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The pull request to fix this issue awaits acceptance.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:XVulDB
3.17.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:RVulDB
3.07.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:RVulDB
2.07.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:CVulDB

Weaknesses

Affected Products

ProductVersions
mcp-bridge-apiINQUIRELAB
  • b30a82aa1d1d1139e0de846c41c8aadee6e06114Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.