Threats affecting pkg:github/leesinliang/godot-mcp

CVE-2026-19044 is a command injection vulnerability in the LeeSinLiang godot-mcp project version 0.1.0. The flaw exists in the executeOperation function within src/index.ts, specifically in the create_scene/add_node component. It occurs due to unsafe manipulation of the projectPath argument, allowing an attacker with local access to execute arbitrary commands. The project maintainers have been informed but have not yet responded or issued a fix. The vulnerability has a medium severity score of 4.8 and requires local privileges to exploit.