Description

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T15:16:48.910Z",
  "pubdate": "2026-08-06T15:16:48.910Z",
  "executiveSummary": "A critical command injection vulnerability has been identified within the godot-mcp project developed by LeeSinLiang, specifically affecting version 0.1.0.\nThe security flaw resides in the executeOperation function located within the src/index.ts source file, specifically affecting the create_scene/add_node component.\nThe vulnerability allows a local attacker to manipulate the projectPath argument, resulting in arbitrary command execution on the underlying host operating system.\nThis flaw presents severe risk implications, potentially leading to complete system compromise, unauthorized data access, and privilege escalation within the context of the executing process.\nExploitation of this vulnerability requires local access to the target system and the ability to interact with the vulnerable component by supplying malicious input via the projectPath parameter.\nGiven that the project maintainers were notified via an issue report and have not yet provided a response or official patch, users must exercise caution and implement alternative defensive measures to mitigate potential local exploitation risks.",
  "technicalDetails": "The root cause of the vulnerability stems from improper neutralization of special elements used in operating system commands, a classic command injection pattern classified under CWE-78.\nSpecifically, the vulnerability exists in the executeOperation function within the src/index.ts file of the create_scene/add_node component.\nDuring execution, the component processes the projectPath argument passed to it without adequate sanitization, validation, or safe API utilization (such as avoiding shell interpretation via exec functions with concatenated strings).\nWhen an attacker supplies a maliciously crafted string containing command separators or payload syntax via the projectPath argument, the input is passed directly to the underlying system shell.\nThe attack flow proceeds as follows: First, the local adversary interacts with the vulnerable godot-mcp application or interface exposing the create_scene/add_node component. Second, the attacker supplies a payload designed to break out of the intended file path context and append arbitrary system commands within the projectPath argument. Third, the executeOperation function processes the input and executes it through the host environment shell. Finally, the injected commands execute with the privileges and permissions of the user running the Node.js process, leading to unauthorized operations on the host system.\nThe affected version is explicitly 0.1.0 of the LeeSinLiang godot-mcp repository.\nAuthentication requirements depend on the local execution context, but the attack strictly requires local access to target the application.\nPrivilege requirements are limited to the execution permissions of the local user running the vulnerable service or script.\nNetwork exposure is not strictly required as the attack vector is local, though dependent interfaces could theoretically expose internal invocation methods.\nPost-exploitation impact includes arbitrary command execution, potential lateral movement, data exfiltration, and total integrity loss of the local development environment."
}