6.3
MediumCVSS 3.1 · from VulDB
CVE-2026-116102
QuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection
docker-mcp · OS command injection · CWE-78Affecteddocker-mcp
FixNo fix listed yet.
PublishedOct 26, 00:30 · VulDB
ScoredOct 26 · 6.3 · VulDB
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py. This manipulation of the argument project_name causes os command injection. It is possible to initiate the attack remotely.
From VulDB
Affected and fixed versions
ProductAffectedFixed indocker-mcp0.1.0–docker-mcp0.2.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known