What is CVE-2026-19044?

CVE-2026-19044 is a medium-severity vulnerability in Leesinliang Godot-Mcp, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 5.3/10. Published 2026-08-06.

How severe is CVE-2026-19044?

Medium severity. CVSS v3 base score is 5.3 out of 10.

RCE in Leesinliang Godot-Mcp

CVE-2026-19044

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.

EPSS: 0.007 (51.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Leesinliang Godot-mcp — versions 0.1.0

Weakness classification (CWE)

References

cna@vuldb.com (technical-description, vdb-entry)
cna@vuldb.com (signature, permissions-required)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (issue-tracking)
cna@vuldb.com (product)

Frequently asked questions

What is CVE-2026-19044?: CVE-2026-19044 is a medium-severity vulnerability in Leesinliang Godot-Mcp, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 5.3/10. Published 2026-08-06.
How severe is CVE-2026-19044?: Medium severity. CVSS v3 base score is 5.3 out of 10.