CVE-2026-5327

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5327
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5327.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5327
Aliases
Published
2026-04-02T11:45:11.124Z
Modified
2026-07-08T08:09:46.623643517Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection
Details

A security flaw has been discovered in efforthye fast-filesystem-mcp up to 3.5.1. The affected element is the function handleGetDiskUsage of the file src/index.ts. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.5.1"
                },
                {
                    "last_affected": "3.5.1"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5327.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-74",
        "CWE-77"
    ]
}
References

Affected packages

Git / github.com/efforthye/fast-filesystem-mcp

Affected ranges

Type
GIT
Repo
https://github.com/efforthye/fast-filesystem-mcp
Events
Introduced
dcd4b376404efe25b30541b562d3ed979d8a1dda
Last affected
dcd4b376404efe25b30541b562d3ed979d8a1dda
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.5.0"
        },
        {
            "last_affected": "3.5.0"
        }
    ]
}

Affected versions

3.*
3.5.0
v3.*
v3.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5327.json"