Skip to content

fix(mcp): replace execSync with spawnSync to prevent command injection #9784

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
davidfirst merged 2 commits into from
Jun 30, 2025
Merged

fix(mcp): replace execSync with spawnSync to prevent command injection #9784

davidfirst merged 2 commits into from
Jun 30, 2025

Conversation

@davidfirst
Copy link
Member

@davidfirst davidfirst commented Jun 30, 2025 •
edited
Loading

Replaces vulnerable execSync calls with secure spawnSync to prevent command injection attacks.
@davidfirst davidfirst merged commit e76b00f into master Jun 30, 2025
10 checks passed
@davidfirst davidfirst deleted the fix/mcp-server-command-injection branch June 30, 2025 21:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants

@davidfirst @GiladShoham