CVE-2026-10691 wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos
Remote attackers can cause denial of service in DesktopCommanderMCP via inefficient regular expressions in the start_search function.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-10691?
CVE-2026-10691 is a medium-severity denial of service vulnerability in wonderwhy-er DesktopCommanderMCP, published on 2 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.2.39 will fix this issue. The patch is named 4ce845f8749b6a159b57b38dcc3357f7222a8078. It is suggested to upgrade the affected component.
Which versions are affected by CVE-2026-10691?
2 open source packages ship an affected version, including @wonderwhy-er/desktop-commander.
| Package | Affected | Fixed in |
|---|---|---|
@wonderwhy-er/desktop-commander npm | All versions | 0.2.39 |
@wonderwhy-er/desktop-commander npm | All versions | 0.2.39 |
How do I fix CVE-2026-10691?
Upgrade @wonderwhy-er/desktop-commander to 0.2.39 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-10691 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-10691 exists.
Sources
Also known as GHSA-r87g-78mx-3wg4.