CVE-2026-10691

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10691
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10691.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10691
Aliases
Published
2026-06-02T23:30:14Z
Modified
2026-10-28T02:31:00Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos
Details

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.2.39 will fix this issue. The patch is named 4ce845f8749b6a159b57b38dcc3357f7222a8078. It is suggested to upgrade the affected component.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-1333",
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10691.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "0.2.8"
                        },
                        {
                            "last_affected": "0.2.8"
                        },
                        {
                            "introduced": "0.2.10"
                        },
                        {
                            "last_affected": "0.2.10"
                        },
                        {
                            "introduced": "0.2.12"
                        },
                        {
                            "last_affected": "0.2.12"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandaloneSingleVersion"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/wonderwhy-er/desktopcommandermcp

Affected ranges

Type
GIT
Repo
https://github.com/wonderwhy-er/desktopcommandermcp
Events
Introduced
b8d83310f95b5826744069db77e26e9ef1bb4227
Fixed
4ce845f8749b6a159b57b38dcc3357f7222a8078
Fixed
b3dfe1a379b059374095abbafd01e986645f045c
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.2.0"
                },
                {
                    "last_affected": "0.2.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.1"
                },
                {
                    "last_affected": "0.2.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.2"
                },
                {
                    "last_affected": "0.2.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.3"
                },
                {
                    "last_affected": "0.2.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.4"
                },
                {
                    "last_affected": "0.2.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.5"
                },
                {
                    "last_affected": "0.2.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.6"
                },
                {
                    "last_affected": "0.2.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.7"
                },
                {
                    "last_affected": "0.2.7"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.9"
                },
                {
                    "last_affected": "0.2.9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.11"
                },
                {
                    "last_affected": "0.2.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.13"
                },
                {
                    "last_affected": "0.2.13"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.14"
                },
                {
                    "last_affected": "0.2.14"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.15"
                },
                {
                    "last_affected": "0.2.15"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.16"
                },
                {
                    "last_affected": "0.2.16"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.17"
                },
                {
                    "last_affected": "0.2.17"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.18"
                },
                {
                    "last_affected": "0.2.18"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.19"
                },
                {
                    "last_affected": "0.2.19"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.20"
                },
                {
                    "last_affected": "0.2.20"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.21"
                },
                {
                    "last_affected": "0.2.21"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.22"
                },
                {
                    "last_affected": "0.2.22"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.23"
                },
                {
                    "last_affected": "0.2.23"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.24"
                },
                {
                    "last_affected": "0.2.24"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.25"
                },
                {
                    "last_affected": "0.2.25"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.26"
                },
                {
                    "last_affected": "0.2.26"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.27"
                },
                {
                    "last_affected": "0.2.27"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.28"
                },
                {
                    "last_affected": "0.2.28"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.29"
                },
                {
                    "last_affected": "0.2.29"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.30"
                },
                {
                    "last_affected": "0.2.30"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.31"
                },
                {
                    "last_affected": "0.2.31"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.32"
                },
                {
                    "last_affected": "0.2.32"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.33"
                },
                {
                    "last_affected": "0.2.33"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.34"
                },
                {
                    "last_affected": "0.2.34"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.35"
                },
                {
                    "last_affected": "0.2.35"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.36"
                },
                {
                    "last_affected": "0.2.36"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.37"
                },
                {
                    "last_affected": "0.2.37"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0.2.38"
                },
                {
                    "last_affected": "0.2.38"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "fixed": "4ce845f8749b6a159b57b38dcc3357f7222a8078"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v0.2.39",
            "range": [
                {
                    "fixed": "b3dfe1a379b059374095abbafd01e986645f045c"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.2.0
0.2.1
0.2.11
0.2.13
0.2.14
0.2.15
0.2.16
0.2.17
0.2.18
0.2.19
0.2.2
0.2.20
0.2.21
0.2.22
0.2.23
0.2.24
0.2.25
0.2.26
0.2.27
0.2.28
0.2.29
0.2.3
0.2.30
0.2.31
0.2.32
0.2.33
0.2.34
0.2.35
0.2.36
0.2.37
0.2.38
0.2.4
0.2.5
0.2.6
0.2.7
0.2.9
v0.*
v0.2.0
v0.2.1
v0.2.13
v0.2.14
v0.2.15
v0.2.16
v0.2.17
v0.2.18
v0.2.19
v0.2.2
v0.2.21
v0.2.22
v0.2.23
v0.2.24
v0.2.25
v0.2.26
v0.2.27
v0.2.28
v0.2.3
v0.2.30
v0.2.31
v0.2.33
v0.2.34
v0.2.35
v0.2.36
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10691.json"