CVE-2026-18482: OS Command Injection
Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS command execution when an AI agent is induced to invoke these tools. Commit 88c77fc fixes these vulnerabilities.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 88c77fc - Configuration
Update the ai/mcp/server/file-system MCP server’s FileSystemService.mjs implementation so caller-controlled absolutePath values are not unsafely interpolated into shell commands in checkSyntax() and runPlaywrightTest(); apply commit 88c77fc.
ai/mcp/server/file-system (FileSystemService.mjs) command interpolation in checkSyntax() and runPlaywrightTest() = no shell/unsafe interpolation
Event History
Frequently Asked Questions
Which tool operations are affected?
The affected operations are checkSyntax() and runPlaywrightTest() in FileSystemService.mjs of the ai/mcp/server/file-system MCP server.
What does an attacker need in order to exploit this issue?
An attacker needs to induce an AI agent to invoke one of the affected tools with a caller-controlled absolutePath value. That value is unsafely interpolated into a shell command, allowing arbitrary operating-system command execution.
What remediation is identified?
The vulnerability is fixed by commit 88c77fc4.