Low
MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection
Type: advisorySources: OSV
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. Upgrading to version 1.11.9 is sufficient to resolve this issue. The identifier of the patch is a40f54d4533ba6618e1749383a245900eeb024c1. The affected component should be upgraded.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-19041
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 18:52 UTC · Revision 1
Source evidence
MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection
core-osv · Original sourcePublished 6 Aug 2026, 13:30 UTC
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. Upgrading to version 1.11.9 is sufficient to resolve this issue. The identifier of the patch is a40f54d4533ba6618e1749383a245900eeb024c1. The affected component should be upgraded.
osv:CVE-2026-19041
Complete source record
{
"id": "b2acc15bc138879ed35bf267da4fc632050ebf34e3137ffb86e13c86b9b07fd6",
"url": "https://osv.dev/vulnerability/CVE-2026-19041",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection",
"summary": "A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. Upgrading to version 1.11.9 is sufficient to resolve this issue. The identifier of the patch is a40f54d4533ba6618e1749383a245900eeb024c1. The affected component should be upgraded.",
"evidence": "osv:CVE-2026-19041",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-19041",
"aliases": [
"CVE-2026-19041"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/missionsquad/mcp-api",
"type": "GIT",
"events": [
{
"introduced": "8860b2ed0d662781325d18ebdc40be1c3d0ef87b"
},
{
"fixed": "a40f54d4533ba6618e1749383a245900eeb024c1"
},
{
"fixed": "379d91a4e35a228abd441e781350f4ea9d2a8665"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "1.11.0"
},
{
"last_affected": "1.11.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.1"
},
{
"last_affected": "1.11.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.2"
},
{
"last_affected": "1.11.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.3"
},
{
"last_affected": "1.11.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.4"
},
{
"last_affected": "1.11.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.5"
},
{
"last_affected": "1.11.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.6"
},
{
"last_affected": "1.11.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.7"
},
{
"last_affected": "1.11.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.8"
},
{
"last_affected": "1.11.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"fixed": "a40f54d4533ba6618e1749383a245900eeb024c1"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "379d91a4e35a228abd441e781350f4ea9d2a8665"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.11.9"
}
]
}
}
],
"versions": [
"1.11.0",
"1.11.1",
"1.11.2",
"1.11.3",
"1.11.4",
"1.11.5",
"1.11.6",
"1.11.7",
"1.11.8",
"v1.11.8",
"v1.11.7",
"v1.11.6",
"v1.11.5",
"v1.11.4",
"v1.11.3",
"v1.11.2",
"v1.11.1",
"v1.11.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19041.json"
}
}
],
"modified": "2026-10-28T02:30:22.397611649Z",
"provider": "osv",
"references": [
"https://github.com/MissionSquad/mcp-api/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19041.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19041",
"https://vuldb.com/cve/CVE-2026-19041",
"https://vuldb.com/submit/863830",
"https://vuldb.com/vuln/386460",
"https://github.com/MissionSquad/mcp-api/issues/41",
"https://vuldb.com/vuln/386460/cti",
"https://github.com/MissionSquad/mcp-api/commit/a40f54d4533ba6618e1749383a245900eeb024c1",
"https://github.com/MissionSquad/mcp-api/pull/44",
"https://github.com/MissionSquad/mcp-api/releases/tag/v1.11.9"
],
"provider_metadata": {
"cwe_ids": [
"CWE-74",
"CWE-77"
],
"cna_assigner": "VulDB",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19041.json"
}
},
"related_cves": [
{
"value": "CVE-2026-19041",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 488802,
"published_at": "2026-08-06T13:30:13.459+00:00"
}