CVE-2026-2130: mcp-maigret Command Injection Vulnerability
Summary
CVE-2026-2130: mcp-maigret vulnerable to command injection. Affects mcp-maigret versions < 1.0.13. Fixed in 1.0.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mcp-maigret is an open-source package designed for username searching across various platforms. It provides users with the ability to quickly find usernames and gather information about them. The package is widely used in security research and social media analysis. However, a vulnerability was discovered in versions up to 1.0.12, which exposes it to command injection attacks, potentially allowing malicious users to execute arbitrary commands on the server.
Vulnerability Detail
The vulnerability in mcp-maigret arises from improper handling of user input in the search_username component located in src/index.ts. By manipulating the Username argument, an attacker can inject commands that the system may execute, leading to unauthorized access or control over the server. This vulnerability can be exploited remotely, making it particularly dangerous. The potential ramifications include data breaches, system compromise, and unauthorized actions performed on behalf of the user.
How To Fix
Latest published version: 1.0.17 as of 22 Oct 2026
npm install mcp-maigret@1.0.17Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.13
This is the first release that contains the fix.
npm install mcp-maigret@1.0.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, validate and sanitize all user inputs before processing them. Ensure that the Username argument does not contain any special characters or command sequences that could be executed.
Conclusion
The command injection vulnerability in mcp-maigret poses a significant risk to users of the package. It is crucial to upgrade to the patched version 1.0.13 to mitigate the risk of exploitation. Additionally, implementing input validation can further enhance security.
See every vulnerability recorded for mcp-maigret →
FAQ
Command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a host operating system via a vulnerable application.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and the ability for attackers to execute commands on the server.
Yes, upgrading to version 1.0.13 of mcp-maigret will patch the vulnerability.
The CVSS score for this vulnerability is 6.3, indicating a moderate level of risk.
