CVE-2026-10690 | THREATINT

Description

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa. It is best practice to apply a patch to resolve this issue.

PUBLISHED Reserved 2026-06-02 | Published 2026-06-02 | Updated 2026-06-03 | Assigner VulDB

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

MEDIUM: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

MEDIUM: 6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

6.5AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Problem types

Server-Side Request Forgery

Product status

0.2.37

affected

Timeline

2026-06-02:	Advisory disclosed
2026-06-02:	VulDB entry created
2026-06-02:	VulDB entry last update

Credits

skywings (VulDB User) reporter

References

vuldb.com/submit/830735 exploit

vuldb.com/vuln/367959 (VDB-367959 | wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery) vdb-entry technical-description

vuldb.com/vuln/367959/cti (VDB-367959 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/cve/CVE-2026-10690 (CVE-2026-10690 | CVE Analysis and Report) third-party-advisory

vuldb.com/submit/830735 (Submit #830735 | wonderwhy-er DesktopCommanderMCP 0.2.37 Server-Side Request Forgery) third-party-advisory

github.com/wonderwhy-er/DesktopCommanderMCP/issues/410 exploit issue-tracking

github.com/...ommit/53699bebba9950047bca16ac4dc8f0568f596aaa patch

github.com/wonderwhy-er/DesktopCommanderMCP/ product

cve.org (CVE-2026-10690)

nvd.nist.gov (CVE-2026-10690)

Download JSON