CVE-2026-19263 INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection
Remote attackers can execute arbitrary commands via the Servers Endpoint in INQUIRELAB mcp-bridge-api due to improper input validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19263?
CVE-2026-19263 is a medium-severity command injection vulnerability in INQUIRELAB mcp-bridge-api, published on 8 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/args results in command injection. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The pull request to fix this issue awaits acceptance.
Which versions are affected by CVE-2026-19263?
How do I fix CVE-2026-19263?
No fix has been published for CVE-2026-19263 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-19263 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-19263 exists.
Sources
Also known as GHSA-c8c4-xf97-vvc8.