Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate ca…
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.03431·Published 2026-08-20·Fixed in 88c77fc4CWE-78