CVE-2026-113378: OS Command Injection in mcollina mcp-ripgrep

This vulnerability involves an OS command injection in the mcollina mcp-ripgrep project up to version 0.4.0. Specifically, the fileType argument in the Advanced Search Tool's src/index.ts is not escaped properly, unlike sibling arguments that use escapeShellArg. This oversight (CWE-78) allows a local attacker to inject arbitrary OS commands when the server executes shell commands via the ripgrep tool. The exploit code has been publicly released, though the vulnerability's real existence is somewhat doubted. The maintainer notes that while arguments are generally escaped, fileType is an exception, and the tool inherently runs shell commands on the host machine.

Successful exploitation allows a local attacker to execute arbitrary OS commands on the affected system with the privileges of the mcp-ripgrep process. This can lead to partial system compromise depending on the privileges of the process. The attack requires local access and does not require user interaction. The CVSS 4.0 base score is 4.8 (medium severity), reflecting the limited attack vector and privileges required.

No official patch or fix is currently available or documented. Users should exercise caution when providing input to the fileType argument, especially avoiding untrusted input. Monitoring for updates from the project maintainer is recommended to apply any future fixes. Since this is a local vulnerability, restricting local access to trusted users can reduce risk.