CVE-2026-19263 PUBLISHED

INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection

Assigner: VulDB
Reserved: 07.08.2026 Published: 08.08.2026 Updated: 08.08.2026

A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/args results in command injection. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The pull request to fix this issue awaits acceptance.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CVSS Score: 6.9

Product Status

Vendor INQUIRELAB
Product mcp-bridge-api
Versions
  • Version b30a82aa1d1d1139e0de846c41c8aadee6e06114 is affected

Credits

  • gongyanyu02 (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Command Injection CWE
  • Injection CWE