CVE-2025-66401: MCP Watch Critical Command Injection Vulnerability Leading to Remote Code Execution
Summary
CVE-2025-66401: The MCPScanner class contains a critical Command Injection vulnerability in the cloneRepo method. Affects mcp-watch versions < 0.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MCP Watch is an open-source tool designed for monitoring and scanning GitHub repositories for various issues. It leverages the Git version control system to clone repositories and analyze their contents. However, it has a critical vulnerability in its command execution logic that allows for command injection, posing significant risks to users and systems running the application.
Vulnerability Detail
The vulnerability resides in the MCPScanner class, specifically in the cloneRepo method, where the user-supplied githubUrl argument is passed directly to a system shell via execSync without any sanitization. This oversight allows attackers to append shell metacharacters to the URL, enabling them to execute arbitrary commands on the host machine. The implications of this vulnerability are severe, as it can lead to remote code execution (RCE), compromising the integrity and security of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the cloneRepo method with untrusted URLs. If you must use the tool, ensure that the URLs provided are from trusted sources and do not contain any shell metacharacters. Additionally, consider running the tool in a controlled environment where it cannot access sensitive resources.
Conclusion
The MCP Watch tool contains a critical command injection vulnerability that allows for remote code execution. Users are strongly advised to update to the latest version of the package to mitigate this risk. In the meantime, implementing workarounds and exercising caution with input URLs can help reduce exposure to this vulnerability.
See every vulnerability recorded for mcp-watch →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
The risks include arbitrary code execution on the host machine, which can lead to data exfiltration, service disruption, or further lateral movement within the infrastructure.
Yes, a patch is available. Update the MCP Watch package to the latest version to mitigate the vulnerability.
If you cannot update the package, avoid using the cloneRepo method with untrusted URLs and run the tool in a controlled environment.
