CVE-2026-2130 is a medium severity command injection (CVSS 6.3) in mcp-maigret, an MCP server by BurtTheCoder, in versions up to 1.0.12. The Username argument of the search_username tool could reach a shell command. Version 1.0.13 fixes it, so upgrade.
What's affected
The record names mcp-maigret versions up to 1.0.12 and says upgrading to 1.0.13 mitigates the issue. The patch is commit b1ae073. The weaknesses are CWE-77 (command injection) and CWE-74 (injection). The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
The flaw is in src/index.ts, in the search_username tool. The commit shows the fix: it replaces exec with execFile so that no shell interpolates the input, adds validation of the username, URL and tags, and passes the Docker command arguments as an array instead of a joined string. The record does not mark the issue as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
MCP servers are often installed once and forgotten, so look in the usual places. Check your MCP client configuration files for an entry that starts mcp-maigret, and note whether it points at a local checkout, an npx call or a global install.
npm ls -g mcp-maigret
For a local clone, check the package version.
grep '"version"' package.json
Anything up to 1.0.12 is affected. Also ask who can talk to the agent that uses the server, because the dangerous input is a username that a model or a person passes to the tool.
What to do now
- Upgrade mcp-maigret to 1.0.13 or later, and restart the MCP client so it loads the new code.
- Remove the server from any client where you do not use it.
- Run MCP servers with the least privilege you can, in a container or a separate account with no access to secrets or source code.
- Treat arguments that a model passes to tools as untrusted input, and validate them in the tool itself.
- Keep an inventory of the MCP servers your team installs, with versions, so that an advisory like this takes minutes to answer.
Why it matters
Command injection happens when a program builds a shell command from input and the shell treats part of that input as instructions. The usual cause is a call like exec with a joined string. The safe pattern, which the fix uses, is to call the program directly with its arguments as a list, so nothing parses the input as a command.
MCP servers add a new angle. They sit between a language model and real tools, and the model fills in arguments from whatever text it has read, including text from a web page or a message that someone else wrote. That makes every argument untrusted, even when your own user typed the prompt. A tool that passes arguments to a shell is therefore reachable by anyone who can put text in front of the model.
The demo shows how a known fix is matched to an installed package.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a score of 6.3 low enough to ignore?
The score needs low privileges, and the impact is limited. It still runs commands on the machine that hosts the server, so a developer laptop with credentials is a real target. The fix is a single upgrade.
Is 1.0.13 the right version?
Yes. The record and the project commit both point to 1.0.13 as the fix.
Sources
Last reviewed: 19 October 2026.
