cbcvebase.
CVE-2025-11491
published 2025-10-08

CVE-2025-11491: A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file…

PriorityP275critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.35%
90.0th percentile
A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Affected

15 ranges
VendorProductVersion rangeFixed in
wonderwhy-erdesktopcommandermcp<= 0.2.13—
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——
wonderwhy-erdesktopcommandermcp——

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.