Threats affecting pkg:github/elgentos/magento2-dev-mcp

CVE-2026-5603 is an OS command injection vulnerability in the elgentos magento2-dev-mcp product versions up to 1.0.2. It affects the executeMagerun2Command function in the src/index.ts file. Exploitation requires local access and can lead to command injection on the operating system level. A patch identified by commit aa1ffcc0aea1b212c69787391783af27df15ae9d is available to remediate this issue. The vulnerability has a medium severity with a CVSS score of 4.8.