Read the docs
TI-2026-76780 Aliases CVE-2026-113378GHSA-qq9r-r4m4-c72m

Command injection in mcollina mcp-ripgrep Advanced Search Tool

Priority MEDIUM 55CWE-77Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

mcollina mcp-ripgrep up to 0.4.0 contains an OS command injection flaw in the Advanced Search Tool, in src/index.ts. The fileType argument reaches the shell without the escaping applied to the other arguments (CWE-78). A local user with low privileges can run OS commands on the host. A public exploit is linked in the references, but the real existence of this flaw is still doubted.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The real existence of this vulnerability is still doubted at the moment. The code's own escapeShellArg on sibling arguments (skipped only for fileType) indicates that this is a CWE-78 oversight, not a documented design. The project maintainer cites the documentation: "This MCP server executes shell commands using the ripgrep tool. While efforts have been made to safely escape arguments, use caution when providing input, as it runs commands on your machine."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00836 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mcollinamcp-ripgrep0.1; 0.2; 0.3; 0.4.0—No fix listedCNA
  • mcp-ripgrep Vendormcollina Affected 0.1; 0.2; 0.3; 0.4.0 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcollina:mcp-ripgrep:*:*:*:*:*:*:*:*——mcollina
  • cpe:2.3:a:mcollina:mcp-ripgrep:*:*:*:*:*:*:*:* Versions — — ·mcollina

Remediation

The sources list no fixed version for mcollina mcp-ripgrep.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113378
  2. 2026-10-20 Alias added: GHSA-qq9r-r4m4-c72m
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: LOW → MEDIUM

References

Exploit 1

Other 1

  • TI-2026-69605 Truncated map32 headers throw RangeError in msgpack5 decoder CVSS 3.1HIGH 7.5
  • TI-2026-69603 msgpack5 streaming decoder recursion can exhaust the call stack CVSS 3.1HIGH 7.5
  • TI-2026-69599 Deeply nested input exhausts the stack in msgpack5 decoder CVSS 3.1MEDIUM 5.3
  • TI-2026-69606 Prototype pollution in msgpack5 with partial options CVSS 3.1MEDIUM 6.5
  • TI-2026-69609 Quadratic parsing in msgpack5 streaming decoder blocks the event loop CVSS 3.1MEDIUM 5.9
  • TI-2026-69600 Reserved byte in msgpack5 causes unbounded stream buffering CVSS 3.1MEDIUM 5.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences