{"data":{"id":"426b7587-c527-41fd-bc4f-4332bf2d4669","title":"CVE-2026-0755: gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote…","summary":"CVE-2026-0755 is a command injection flaw in the execAsync method of gemini-mcp-tool that allows remote, unauthenticated attackers to execute arbitrary code on affected installations. The flaw stems from missing validation of a user-supplied string before it is used in a system call, and code runs in the context of the service account.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0755","publishedAt":"2026-01-23T04:16:02.017Z","cveId":"CVE-2026-0755","cweIds":["CWE-78"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gemini-mcp-tool@>= 1.1.2, < 1.1.6 (fixed: 1.1.6)"],"affectedPackageNames":["gemini-mcp-tool"],"affectedPackageRefs":["npm:gemini-mcp-tool"],"affectedVendors":[],"affectedVendorsRaw":["gemini-mcp-tool"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"gemini-mcp-tool command injection in execAsync allows remote code execution","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0342,"epssCheckedAt":"2026-11-04T06:10:14.410Z","kevDateAdded":null,"advisoryAliases":["GHSA-4h5r-5jm8-jxjm"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:13.743Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2026-05-30T10:19:33.386Z","daysToFix":127,"fixCheckedAt":"2026-10-29T21:42:01.148Z","capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"gemini-mcp-tool","fixedVersion":"1.1.6","matchedVersion":"1.1.6","fixReleasedAt":"2026-05-30T10:19:33.386Z","daysToFix":127,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:42:00.999Z"}]}}