CVE-2025-11491: Medium Command Injection in DesktopCommanderMCP

CVE-2025-11491 is a medium severity (CVSS 6.3) OS command injection flaw in DesktopCommanderMCP up to version 0.2.13, in the CommandManager code of src/command-manager.ts. The linked report is titled a blocklist bypass via command substitution. No fixed version is confirmed. Isolate the server and do not rely on its blocklist.

What's affected

• Product: DesktopCommanderMCP by wonderwhy-er, a Model Context Protocol server that lets an AI client run commands and work with files on a computer
• Affected: versions up to and including 0.2.13
• Component: src/command-manager.ts
• Fixed version: none confirmed. The sources we reviewed do not announce a patched release

The public issue is titled Command Blocklist Bypass Via Command Substitution. Command substitution is a shell feature that runs one command inside another and uses its output. A blocklist that inspects only the outer command can miss what the shell runs inside it. We could not retrieve the full body of the report, so this post sticks to its title and the CVE record.

The record classifies the issue as CWE-78 (OS command injection) under CWE-77 (command injection). The CVSS score is 6.3 (MEDIUM), and the vector calls for a low privilege starting point over the network.

How to check if you're exposed

Check which version you run and where the server is reachable.

npm ls -g --depth=0 | grep -i desktop
npm ls | grep -i desktop

If you launch it through an MCP client configuration, open the client's config file and look at the command and arguments that start the server. Note the version pin, if any. Anything up to 0.2.13 is in range.

Then ask who can drive it. This tool is dangerous by design, because it exists to run commands. Look at which MCP clients, agents and users can send it requests, and whether any of them take instructions from web pages, tickets, emails or documents that outsiders can write to.

Finally, check the configured command blocklist. The weakness here concerns the blocklist, so a deployment that never relied on it for safety has a different risk profile from one that did.

What to do now

1. Do not treat the command blocklist as a security boundary. Assume any command the user account can run can be reached through the tool.
2. Run the server as a low privilege user, in a container or virtual machine, with no access to secrets, SSH keys or cloud credentials.
3. Restrict which clients can connect, and require a human to approve commands from agents that read untrusted content.
4. Check the project's GitHub repository for a release after 0.2.13 and read its notes before upgrading. No fixed version is confirmed in the sources reviewed.
5. Log commands the server runs and review them. Unexpected paths or shell syntax in command strings are a signal.
6. Inventory MCP servers across developer machines. They are easy to install and easy to forget.

Why it matters

This is a sibling of CVE-2025-11490. Both concern the same file and the same control, a list of commands the server should refuse. They describe two different ways around it, one through absolute paths and one through shell command substitution.

Two bypasses in the same control is the usual sign that the control is the wrong tool. Parsing shell input well enough to block the right things is very hard, because the shell itself is a language with quoting, expansion, aliases and nesting. A filter that tries to understand it will be wrong somewhere.

The safer pattern for any agent tool that runs commands is containment. Give it a throwaway environment, no secrets, narrow network access and a human approval step for anything risky. The record is not a CISA KEV entry and we found no report of exploitation, but the exploit is described as public.

Quick check

Sources

• GitHub issue 217, Command Blocklist Bypass Via Command Substitution
• CVE record and CVSS vector for CVE-2025-11491, published 2025-10-08

Last reviewed: 19 October 2026.