cfdude CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH cfdude CVE published 2026-10-12

CVE-2026-108953

The mac-shell-mcp package before version 2.0.0 contains an OS command injection vulnerability. This vulnerability allows MCP clients to bypass the command whitelist by injecting shell metacharacters into execute_command arguments, potentially leading to unauthorized command execution as the server user. Defenders should assess exposure and prioritize verification and remediation efforts. The CVE record wa [truncated]