How many CVEs does wonderwhy-er DesktopCommanderMCP have?

wonderwhy-er DesktopCommanderMCP has 5 published CVE records since 2025.

How many wonderwhy-er DesktopCommanderMCP CVEs are in CISA KEV?

None of wonderwhy-er DesktopCommanderMCP's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for wonderwhy-er DesktopCommanderMCP vulnerabilities?

Yes — 5 of wonderwhy-er DesktopCommanderMCP's CVEs have a known public exploit.

Which versions of wonderwhy-er DesktopCommanderMCP are affected?

55 distinct wonderwhy-er DesktopCommanderMCP versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in wonderwhy-er DesktopCommanderMCP CVEs?

wonderwhy-er DesktopCommanderMCP's CVEs most often map to these CWE weakness types: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')), CWE-400 (Uncontrolled Resource Consumption), CWE-61 (UNIX Symbolic Link (Symlink) Following), CWE-918 (Server-Side Request Forgery (SSRF)).

What is the average severity of wonderwhy-er DesktopCommanderMCP CVEs?

The average CVSS base score across wonderwhy-er DesktopCommanderMCP's scored CVEs is 4.6.

wonderwhy-er DesktopCommanderMCP Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every wonderwhy-er DesktopCommanderMCP version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

0.2.04 CVEs
0.2.14 CVEs
0.2.104 CVEs
0.2.114 CVEs
0.2.124 CVEs
0.2.134 CVEs
0.2.24 CVEs
0.2.34 CVEs
0.2.44 CVEs
0.2.54 CVEs
0.2.64 CVEs
0.2.74 CVEs
0.2.84 CVEs
0.2.94 CVEs
0.1.253 CVEs
0.1.263 CVEs
0.1.273 CVEs
0.1.293 CVEs
0.1.353 CVEs
0.1.373 CVEs
0.1.393 CVEs
v.0.1.283 CVEs
v.0.1.313 CVEs
v.0.1.333 CVEs
0.2.141 CVE
0.2.151 CVE
0.2.161 CVE
0.2.171 CVE
0.2.181 CVE
0.2.191 CVE
0.2.201 CVE
0.2.211 CVE
0.2.221 CVE
0.2.231 CVE
0.2.241 CVE
0.2.251 CVE
0.2.261 CVE
0.2.271 CVE
0.2.281 CVE
0.2.291 CVE
0.2.301 CVE
0.2.311 CVE
0.2.321 CVE
0.2.331 CVE
0.2.341 CVE
0.2.351 CVE
0.2.361 CVE
0.2.371 CVE
0.2.381 CVE

Version ranges

<= 0.2.133 CVEs
>= 0.2.371 CVE
>= 0.2.391 CVE

Fixed in

0.2.391 CVE
4ce845f8749b6a159b57b38dcc3357f7222a80781 CVE
b3dfe1a379b059374095abbafd01e986645f045c1 CVE

Find a version

5 CVEs

Sort

wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos
CVE-2026-10691
Public exploit
Patch
CWE-400
Medium · CVSS 5.3
EPSS 0.4% (28th pct)2026-06-02
wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery
CVE-2026-10690
Public exploit
Patch
CWE-918
Medium · CVSS 5.3
EPSS 0.2% (13th pct)2026-06-02
wonderwhy-er DesktopCommanderMCP command-manager.ts CommandManager os command injection
CVE-2025-11491
Public exploit
CWE-77
Medium · CVSS 5.3
EPSS 4.3% (90th pct)2025-10-08
wonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injection
CVE-2025-11490
Public exploit
CWE-77
Medium · CVSS 5.3
EPSS 3.5% (88th pct)2025-10-08
wonderwhy-er DesktopCommanderMCP filesystem.ts isPathAllowed symlink
CVE-2025-11489
Public exploit
CWE-61
Low · CVSS 2.0
EPSS 0.2% (14th pct)2025-10-08

wonderwhy-er DesktopCommanderMCP Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other wonderwhy-er products

Frequently asked questions

References

Track wonderwhy-er DesktopCommanderMCP vulnerabilities