CVE-2026-23882: Blinko: Admin RCE - MCP Server Command Injection
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP (Model Context Protocol) server creation function allows specifying arbitrary commands and arguments, which are executed when testing the connection. This issue has been patched in version 1.8.4.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23882?
CVE-2026-23882 is classified as a critical vulnerability due to its potential to allow remote code execution through command injection.
How do I fix CVE-2026-23882?
To fix CVE-2026-23882, upgrade Blinko to version 1.8.4 or later, which resolves the command injection issue.
Which versions of Blinko are affected by CVE-2026-23882?
CVE-2026-23882 affects all versions of Blinko prior to 1.8.4.
What is command injection in the context of CVE-2026-23882?
Command injection in CVE-2026-23882 refers to the ability for an attacker to execute arbitrary commands on the server via the MCP connection tests.
Who is impacted by CVE-2026-23882?
Users of Blinko versions earlier than 1.8.4 are vulnerable to CVE-2026-23882 and should take immediate action to mitigate the risk.