CVE-2026-113378

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The real existence of this vulnerability is still doubted at the moment. The code's own escapeShellArg on sibling arguments (skipped only for fileType) indicates that this is a CWE-78 oversight, not a documented design. The project maintainer cites the documentation: "This MCP server executes shell commands using the ripgrep tool. While efforts have been made to safely escape arguments, use caution when providing input, as it runs commands on your machine."

• CWE-77
• CWE-78

• https://gist.github.com/sandh0t/45fdee24a7907e0cd836aed26f2d5a7a/
• https://github.com/mcollina/mcp-ripgrep#security-considerations
• https://vuldb.com/cve/CVE-2026-113378
• https://vuldb.com/submit/990464
• https://vuldb.com/vuln/422653
• https://vuldb.com/vuln/422653/cti

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-113356DokuWiki before 2026-07-14c contains a PHP object injection …7.5
• CVE-2026-113357@e2e-dev/github before 0.4.1 contains an improper authorizat…3.5
• CVE-2026-113358LavaLite CMS through 10.1.2 contains a missing authenticatio…7.5
• CVE-2026-113359Baserow before 2.3.0 contains a missing authorization vulner…4.3
• CVE-2026-11336A vulnerability has been found in tittuvarghese CollegeManag…6.3
• CVE-2026-11337A vulnerability was found in tittuvarghese CollegeManagement…4.3
• CVE-2026-11338A security vulnerability has been detected in SourceCodester…2.4
• CVE-2026-113380In the RingRTC library before 2.72.0 for Signal, a peer that…9.3
• CVE-2026-113381A weakness has been identified in Osclass up to 8.3.1. Affec…7.3
• CVE-2026-113382A security vulnerability has been detected in arizu-id fast-…6.3
• CVE-2026-113383A vulnerability was detected in Optimal IdM OptimalCloud 5.0…4.3
• CVE-2026-113384A flaw has been found in Optimal IdM OptimalCloud 5.0. This …4.3