Threat database

CVE-2026-116102 is an OS command injection vulnerability in QuantGeekDev docker-mcp versions 0.1.0 and 0.2.0. The flaw exists in the _build_windows_command function within docker_executor.py, where improper handling of the project_name argument allows remote attackers to execute arbitrary OS commands. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.3.

CVE-2026-39313 is a high-severity vulnerability in the QuantGeekDev mcp-framework versions 0.2.21 and below. The vulnerability arises because the readRequestBody() function concatenates HTTP request body chunks without enforcing any size limit, despite the existence of a maxMessageSize configuration parameter. This allows a remote unauthenticated attacker to send a single large POST request to the /mcp endpoint, causing memory exhaustion and denial of service. The issue has been fixed in version 0.2.22.