CVE-2026-116102: QuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection
Published Oct 26, 2026
·Updated
A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function buildwindowscommand of the file dockerexecutor.py. This manipulation of the argument projectname causes os command injection. It is possible to initiate the attack remotely.
Affected Software
1 affected component
QuantGeekDev docker-mcp=0.1.0, =0.2.0
Event History
Oct 26, 2026
CVE Published
via MITRE·12:30 AM
Data Sourced
via MITRE·12:30 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which versions are identified as affected?
QuantGeekDev docker-mcp versions 0.1.0 and 0.2.0 are identified as affected.
2
What input is involved in exploitation?
The issue is triggered by manipulation of the project_name argument in the _build_windows_command function in docker_executor.py.
3
Can an attacker exploit this remotely without credentials?
The available data states that the attack can be initiated remotely. The vector is network-based and no privileges are required, although user interaction is required.