CVE-2026-10691

MEDIUM 4.3

wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.2.39 will fix this issue. The patch is named 4ce845f8749b6a159b57b38dcc3357f7222a8078. It is suggested to upgrade the affected component.

CWE	CWE-1333 CWE-400
Vendor	wonderwhy-er
Product	desktopcommandermcp
Published	Jun 2, 2026
Last Updated	Jun 3, 2026

Stay Ahead of the Next One

Get instant alerts for wonderwhy-er desktopcommandermcp

Be the first to know when new medium vulnerabilities affecting wonderwhy-er desktopcommandermcp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

wonderwhy-er / DesktopCommanderMCP

0.2.0 0.2.1 0.2.2 0.2.3 0.2.4 0.2.5 0.2.6 0.2.7 0.2.8 0.2.9 0.2.10 0.2.11 0.2.12 0.2.13 0.2.14 0.2.15 0.2.16 0.2.17 0.2.18 0.2.19 0.2.20 0.2.21 0.2.22 0.2.23 0.2.24 0.2.25 0.2.26 0.2.27 0.2.28 0.2.29 0.2.30 0.2.31 0.2.32 0.2.33 0.2.34 0.2.35 0.2.36 0.2.37 0.2.38

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/367960 vuldb.com: https://vuldb.com/vuln/367960/cti vuldb.com: https://vuldb.com/cve/CVE-2026-10691 vuldb.com: https://vuldb.com/submit/830746 github.com: https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/375 github.com: https://github.com/wonderwhy-er/DesktopCommanderMCP/pull/400 github.com: https://github.com/wonderwhy-er/DesktopCommanderMCP/commit/4ce845f8749b6a159b57b38dcc3357f7222a8078 github.com: https://github.com/wonderwhy-er/DesktopCommanderMCP/releases/tag/v0.2.39 github.com: https://github.com/wonderwhy-er/DesktopCommanderMCP/

Credits

🔍 skywings (VulDB User)