CVE-2025-11491

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
wonderwhy-er	DesktopCommanderMCP	0.2.0; 0.2.1; 0.2.2; 0.2.3; 0.2.4; 0.2.5; 0.2.6; 0.2.7; 0.2.8; 0.2.9; 0.2.10; 0.2.11; 0.2.12; 0.2.13

References

https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/217Exploit, Issue Tracking, Vendor Advisory
https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/217#issue-3343853704Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.327610Permissions Required, VDB Entry
https://vuldb.com/?id.327610Third Party Advisory, VDB Entry
https://vuldb.com/?submit.668006Third Party Advisory, VDB Entry

Timeline

Published: Oct 8, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-114927.5In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor w CVE-2025-114937.5The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, an CVE-2025-114945.5A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the CVE-2025-114955.5A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-CVE-2025-114966.1The Five Star Restaurant Reservations – WordPress Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CVE-2025-114974.3The Advanced Database Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6. CVE-2025-114986.1An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runt CVE-2025-114999.8The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploa CVE-2025-11503.1A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of t CVE-2025-115008.7Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for inte CVE-2025-115017.5The Dynamically Display Posts plugin for WordPress is vulnerable to SQL Injection via the 'tax_query' parameter in all versions up to, and i CVE-2025-115026.4The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_mul