CVE-2026-2130 BurtTheCoder mcp-maigret search_username index.ts command injection
Remote attackers can execute arbitrary commands via the username argument in the search_username function of the mcp-maigret library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2130?
CVE-2026-2130 is a medium-severity command injection vulnerability in BurtTheCoder mcp-maigret, published on 8 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was determined in BurtTheCoder mcp-maigret up to 1.0.12. This affects an unknown part of the file src/index.ts of the component search_username. Executing a manipulation of the argument Username can lead to command injection. The attack may be launched remotely. Upgrading to version 1.0.13 is able to mitigate this issue. This patch is called b1ae073c4b3e789ab8de36dc6ca8111ae9399e7a. Upgrading the affected component is advised.
Which versions are affected by CVE-2026-2130?
2 open source packages ship an affected version, including mcp-maigret. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mcp-maigret npm | All versions | 1.0.13 |
mcp-maigret npm | All versions | 1.0.13 |
Products include Burtthecoder Maigret Mcp Server.
How do I fix CVE-2026-2130?
Upgrade mcp-maigret to 1.0.13 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-2130 being exploited?
There is no known exploitation of CVE-2026-2130 in the wild and no public exploit code.
Sources
Also known as GHSA-2g7v-hghf-grg4.