CVE-2026-3680
RyuzakiShinji biome-mcp-server biome-mcp-server.ts command injection
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A security flaw has been discovered in RyuzakiShinji biome-mcp-server up to 1.0.0. Affected by this issue is some unknown functionality of the file biome-mcp-server.ts. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 335e1727147efeef011f1ff8b05dd751d8a660be. Applying a patch is the recommended action to fix this issue.
| CWE | CWE-77 CWE-74 |
| Vendor | ryuzakishinji |
| Product | biome-mcp-server |
| Published | Mar 7, 2026 |
| Last Updated | Mar 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for ryuzakishinji biome-mcp-server
Be the first to know when new medium vulnerabilities affecting ryuzakishinji biome-mcp-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
RyuzakiShinji / biome-mcp-server
1.0
References
vuldb.com: https://vuldb.com/?id.349582 vuldb.com: https://vuldb.com/?ctiid.349582 vuldb.com: https://vuldb.com/?submit.765399 github.com: https://github.com/RyuzakiShinji/biome-mcp-server/pull/1 github.com: https://github.com/user-attachments/files/25466715/biome-mcp-server_security_advisory.pdf github.com: https://github.com/RyuzakiShinji/biome-mcp-server/pull/1/changes/335e1727147efeef011f1ff8b05dd751d8a660be github.com: https://github.com/RyuzakiShinji/biome-mcp-server/
Credits
🔍 Yinci Chen (VulDB User)