CVE-2026-19263

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19263", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-07T14:06:50.940Z", "datePublished": "2026-08-08T06:45:09.304Z", "dateUpdated": "2026-08-11T01:26:34.053Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-08T06:45:09.304Z"}, "title": "INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "INQUIRELAB", "product": "mcp-bridge-api", "versions": [{"version": "b30a82aa1d1d1139e0de846c41c8aadee6e06114", "status": "affected"}], "cpes": ["cpe:2.3:a:inquirelab:mcp-bridge-api:*:*:*:*:*:*:*:*"], "modules": ["Servers Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/args results in command injection. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The pull request to fix this issue awaits acceptance."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C"}}], "timeline": [{"time": "2026-08-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-07T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-07T16:11:56.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "gongyanyu02 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/387010", "name": "VDB-387010 | INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/387010/cti", "name": "VDB-387010 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19263", "name": "CVE-2026-19263 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/865220", "name": "Submit #865220 | INQUIRELAB mcp-bridge-api unknown Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/INQUIRELAB/mcp-bridge-api/issues/1", "tags": ["issue-tracking"]}, {"url": "https://github.com/INQUIRELAB/mcp-bridge-api/issues/1#issuecomment-4320749148", "tags": ["issue-tracking"]}, {"url": "https://github.com/INQUIRELAB/mcp-bridge-api/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"references": [{"url": "https://github.com/INQUIRELAB/mcp-bridge-api/issues/1", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T01:25:40.841844Z", "id": "CVE-2026-19263", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T01:26:34.053Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19263", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T01:25:40.841844Z"}}}], "references": [{"url": "https://github.com/INQUIRELAB/mcp-bridge-api/issues/1", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T01:26:28.649Z"}}], "cna": {"title": "INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection", "credits": [{"lang": "en", "type": "reporter", "value": "gongyanyu02 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:inquirelab:mcp-bridge-api:*:*:*:*:*:*:*:*"], "vendor": "INQUIRELAB", "modules": ["Servers Endpoint"], "product": "mcp-bridge-api", "versions": [{"status": "affected", "version": "b30a82aa1d1d1139e0de846c41c8aadee6e06114"}]}], "timeline": [{"lang": "en", "time": "2026-08-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-07T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-07T16:11:56.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/387010", "name": "VDB-387010 | INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/387010/cti", "name": "VDB-387010 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19263", "name": "CVE-2026-19263 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/865220", "name": "Submit #865220 | INQUIRELAB mcp-bridge-api unknown Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/INQUIRELAB/mcp-bridge-api/issues/1", "tags": ["issue-tracking"]}, {"url": "https://github.com/INQUIRELAB/mcp-bridge-api/issues/1#issuecomment-4320749148", "tags": ["issue-tracking"]}, {"url": "https://github.com/INQUIRELAB/mcp-bridge-api/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/args results in command injection. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The pull request to fix this issue awaits acceptance."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-08T06:45:09.304Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19263", "state": "PUBLISHED", "dateUpdated": "2026-08-11T01:26:34.053Z", "dateReserved": "2026-08-07T14:06:50.940Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-08T06:45:09.304Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:inquirelab:mcp-bridge-api:*:*:*:*:*:*:*:*"], "modules": ["Servers Endpoint"], "product": "mcp-bridge-api", "vendor": "INQUIRELAB", "versions": [{"status": "affected", "version": "b30a82aa1d1d1139e0de846c41c8aadee6e06114"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/args results in command injection. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en INQUIRELAB mcp-bridge-API hasta b30a82aa1d1d1139e0de846c41c8aadee6e06114. El elemento afectado es una funci\u00f3n desconocida del archivo mcp-bridge.js del componente Servers Endpoint. Realizar una manipulaci\u00f3n del argumento command/args resulta en inyecci\u00f3n de comandos. Es posible iniciar el ataque de forma remota. Este producto utiliza una versi\u00f3n continua para proporcionar entrega continua. Por lo tanto, no hay detalles de versi\u00f3n disponibles para las versiones afectadas ni actualizadas. La solicitud de extracci\u00f3n para solucionar este problema espera ser aceptada."}], "id": "CVE-2026-19263", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19263", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T01:25:40.841844Z", "version": "2.0.3"}}]}, "published": "2026-08-08T07:17:11.790", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/INQUIRELAB/mcp-bridge-api/"}, {"source": "cna@vuldb.com", "url": "https://github.com/INQUIRELAB/mcp-bridge-api/issues/1"}, {"source": "cna@vuldb.com", "url": "https://github.com/INQUIRELAB/mcp-bridge-api/issues/1#issuecomment-4320749148"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-19263"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/865220"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/387010"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/387010/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/INQUIRELAB/mcp-bridge-api/issues/1"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b30a82aa1d1d1139e0de846c41c8aadee6e06114"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mcp-bridge-api", "source": "cna", "vendor": "INQUIRELAB"}, "product": "mcp-bridge-api", "vendor": "inquirelab"}], "created": "2026-08-08T08:30:12.866415+00:00", "updated": "2026-08-08T20:40:10.271890+00:00", "vendors": ["inquirelab", "inquirelab$PRODUCT$mcp-bridge-api"]}