CVE-2026-19333

This CVE is a command injection in Supabase-MCP's generate_types function. The vulnerability: the schema argument passed to this code generation tool is not sanitized before being used in shell execution. Any AI assistant with MCP access to this tool can inject arbitrary commands by manipulating the schema input—there's no input validation layer between the schema parameter and system calls. The CVSS 5.3 rating and 'local access only' classification are deeply misleading in the MCP context. Unlike a traditional local vulnerability requiring an attacker to already have shell access, this lives inside an AI assistant that already has ambient awareness of your development environment—file system access, repository context, potentially .env files and CI secrets. The AI doesn't need to 'pivot' to your sensitive data; it's already there. An attacker using this vulnerability isn't executing blind commands on a local machine, they're executing commands through an AI that already sees your project structure. If you're using Supabase-MCP: treat the generate_types function as a shell execution boundary until patched. Do not allow untrusted schema input to reach this tool. If your MCP host exposes this tool to AI assistants with file system or repository permissions, consider disabling it or constraining the AI's capabilities until a patch is available. The project has not responded to the disclosure, so there's no official fix timeline. Check the NightTrek/GitHub repository for updates, but assume this vulnerability will remain unpatched for the foreseeable future—the MCP ecosystem lacks established disclosure coordination frameworks, and small tooling projects often lack security response capacity. This means your defense-in-depth controls (MCP permission scoping, limiting AI assistant file system access, network segmentation) are your primary mitigation, not waiting for a vendor patch. The broader pattern here matters: code generation tools that blend schema transformation with shell execution are an emerging attack surface in AI-orchestrated toolchains. The 'development tool' framing creates a false sense of safety—these tools run with your project context and deserve the same input sanitization scrutiny you'd apply to any privileged execution path.

Reviewed through automated stages and approved by a human before publication.