BurtTheCoder mcp-maigret search_username index.ts command injection
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
A vulnerability was determined in BurtTheCoder mcp-maigret up to 1.0.12. This affects an unknown part of the file src/index.ts of the component search_username. Executing a manipulation of the argument Username can lead to command injection. The attack may be launched remotely. Upgrading to version 1.0.13 is able to mitigate this issue. This patch is called b1ae073c4b3e789ab8de36dc6ca8111ae9399e7a. Upgrading the affected component is advised.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BurtTheCoder | mcp-maigret | 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10; 1.0.11; 1.0.12 | 1.0.13 | Patch available | CNA |
| — | mcp-maigret (npm) | before 1.0.13 | 1.0.13 | Patch available | GHSA-2g7v-hghf-grg4 |
- mcp-maigret VendorBurtTheCoder Affected 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10; 1.0.11; 1.0.12 Fixed in 1.0.13 Patch available CNA
- mcp-maigret (npm) Vendor— Affected before 1.0.13 Fixed in 1.0.13 Patch available GHSA-2g7v-hghf-grg4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:burtthecoder:maigret_mcp_server:*:*:*:*:*:*:*:* | up to 1.0.12 | Vulnerable | BurtTheCoder |
- cpe:2.3:a:burtthecoder:maigret_mcp_server:*:*:*:*:*:*:*:* Versions up to 1.0.12 Vulnerable ·BurtTheCoder
Remediation
- Fix · CNA mcp-maigret (BurtTheCoder) Fixed in 1.0.13
- Fix · GHSA-2g7v-hghf-grg4 mcp-maigret (npm) Fixed in 1.0.13 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2130
- 2026-10-03 Alias added: GHSA-2g7v-hghf-grg4
References
Patch 3
Sources
- CVE-2026-2130 · CVE Program
- CVE-2026-2130 · NVD
- FIRST EPSS
- GHSA-2g7v-hghf-grg4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences