CVE-2026-10690
Last modified
CVE-2026-10690 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa. It is best practice to apply a patch to resolve this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-10690?
How severe is CVE-2026-10690?
How do I fix CVE-2026-10690?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-10684In subsys/debug/coredump/coredump_shell.c, print_coredump_hd…3
- CVE-2026-10685The Zephyr Bluetooth GATT client CCC-write response handler …7.6
- CVE-2026-10686Zephyr's IPv6 forwarding path re-sent routed unicast packets…7.5
- CVE-2026-10687Rejected reason: This CVE Record has been rejected by the Ze…
- CVE-2026-10688A vulnerability was determined in ahujasid blender-mcp up to…5.5
- CVE-2026-1069GitLab has remediated an issue in GitLab CE/EE affecting all…7.5
- CVE-2026-10691A security flaw has been discovered in wonderwhy-er DesktopC…4.3
- CVE-2026-10692A weakness has been identified in johnhuang316 code-index-mc…4.3
- CVE-2026-10693A security vulnerability has been detected in SourceCodester…6.3
- CVE-2026-10694A vulnerability was detected in SourceCodester Online Food O…7.3
- CVE-2026-10695IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable…5.5
- CVE-2026-10696Use of an incorrectly resolved name or reference in the ping…7.5
Are you affected by CVE-2026-10690?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST