CVE-2026-19044

The CVE you are looking at is command injection in godot-mcp, a Model Context Protocol server that integrates the Godot game engine with AI coding assistants. The vulnerability lives in how the server handles the `projectPath` parameter—it passes this input directly to shell execution without sanitization, allowing an attacker who controls this parameter to run arbitrary commands at the privilege level of the process running the MCP server. The CVSS 5.3 score is misleading. The 'local attack vector' penalty treats local access as a constraint, but for an MCP server, local execution is the intended operational model. This tool is designed to be invoked by AI assistants that operate within your development environment. The local access requirement is not a security barrier—it is the baseline threat model. Compromising godot-mcp gives an attacker access to everything your development environment can reach: internal repositories, CI/CD systems, production deployment credentials, SSH keys, and API tokens. This is not a local privilege escalation issue; it is a supply-chain detonation path. The unpatched status compounds the severity. The maintainer has not responded to responsible disclosure, meaning there is no fix and no timeline for one. This creates an extended exposure window where the vulnerable code continues being instantiated in new developer environments, incorporated into tutorials, and normalized in workflows. Abandoned developer tooling with command injection doesn't sit static—it degrades into invisible infrastructure, absorbed into forks and CI configurations where it persists indefinitely. If you have godot-mcp 0.1.0 in your environment, remove it immediately. Do not wait for a patch that may never arrive. Audit any systems where this tool was integrated and rotate any credentials that the development environment could access. Treat unacknowledged command injection in developer tooling as implicitly higher severity than CVSS suggests—the scoring framework was not designed for attack surfaces where local execution is the operational baseline rather than a mitigating factor.

Reviewed through automated stages and approved by a human before publication.