CVE-2026-19333: NightTrek Supabase-MCP RCE Vulnerability

CVE-2026-19333 Overview

CVE-2026-19333 is a command injection vulnerability in the NightTrek Supabase-MCP project, an open-source Model Context Protocol (MCP) server for Supabase. The flaw resides in the generate_types component, where the schema argument is passed to a shell operation without sufficient sanitization. An attacker with local access and low privileges can manipulate the schema parameter to inject arbitrary operating system commands. The affected commits are cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170 and db03237d92f7dc2f0da0d70a87dba84ebcde5b66. According to VulDB, the maintainer was notified through a public issue report but has not responded at the time of disclosure.

Critical Impact
Local attackers can inject arbitrary shell commands through the schema argument of the generate_types MCP tool, resulting in code execution in the context of the MCP server process.

Affected Products

NightTrek Supabase-MCP at commit cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170
NightTrek Supabase-MCP at commit db03237d92f7dc2f0da0d70a87dba84ebcde5b66
The generate_types tool exposed by the Supabase-MCP server

Discovery Timeline

2026-08-09 - CVE-2026-19333 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19333

Vulnerability Analysis

The vulnerability is classified as Command Injection under CWE-74, which covers improper neutralization of special elements in output used by a downstream component. The Supabase-MCP server exposes a generate_types tool that wraps the Supabase CLI to produce TypeScript type definitions from a database schema. The tool accepts a schema argument from an MCP client and forwards that value into a shell command line. Because the argument is concatenated into the command string rather than passed as an isolated argv element, shell metacharacters such as ;, &&, |, and backticks are interpreted by the shell. The EPSS score for this issue is 0.622% with a percentile of 46.8, and no public exploit has been published.

Root Cause

The root cause is unsafe construction of a shell command using untrusted input. The schema parameter is treated as a trusted string and interpolated into a command invocation, likely through a Node.js API such as child_process.exec or a template literal passed to a shell. No allow-list validation or shell-escaping is applied to the argument before execution.

Attack Vector

Exploitation requires local access to the MCP transport with low privileges. An attacker who can reach the MCP server, for example a local user, a compromised MCP client, or a malicious prompt driving an LLM agent, sends a generate_types request with a schema value containing shell metacharacters. The injected payload executes with the privileges of the MCP server process. Impact is limited to the local host, and confidentiality, integrity, and availability effects are all rated Low.

No verified proof-of-concept code has been published. See the GitHub Issue Tracker and the VulDB Vulnerability Details for additional technical context.

Detection Methods for CVE-2026-19333

Indicators of Compromise

Child processes spawned by the Supabase-MCP Node.js runtime that invoke /bin/sh -c with concatenated supabase gen types command lines.
MCP request logs containing generate_types invocations where the schema field includes shell metacharacters such as ;, |, &, $(, or backticks.
Unexpected outbound network connections or file writes originating from the MCP server process shortly after a generate_types call.

Detection Strategies

Enable process telemetry on hosts running Supabase-MCP and alert on shell interpreters spawned as children of the MCP server process.
Instrument the MCP server to log the raw schema argument and apply regex-based detection for characters outside [A-Za-z0-9_].
Correlate MCP tool-invocation logs with host process creation events to identify anomalous command lines derived from user-controlled input.

Monitoring Recommendations

Monitor commits cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170 and db03237d92f7dc2f0da0d70a87dba84ebcde5b66 in deployed environments and flag any installation still pinned to those revisions.
Track the upstream GitHub Project Repository for a maintainer response and patch commit.
Audit MCP client access lists to ensure only trusted local processes can invoke the generate_types tool.

How to Mitigate CVE-2026-19333

Immediate Actions Required

Disable or remove the generate_types tool from the MCP server configuration until a patched revision is available.
Restrict MCP server exposure to trusted local users and processes only, and avoid running the server under privileged accounts.
Validate the schema argument against a strict allow-list of characters, for example ^[A-Za-z_][A-Za-z0-9_]*$, before forwarding it to the Supabase CLI.

Patch Information

No official patch is available. The maintainer was notified through the GitHub Issue Tracker but has not responded according to the VulDB CVE Report. Operators should apply local mitigations and rebuild the tool to pass arguments through execFile or an argv array rather than a shell command string.

Workarounds

Replace child_process.exec calls with child_process.execFile and pass the schema name as a discrete argv element so shell interpretation is bypassed.
Wrap the MCP server in a least-privilege container or sandbox that blocks unexpected process execution and outbound network access.
Remove the generate_types handler from the tool registry if TypeScript type generation is not required in the deployment.

bash

# Configuration example - argv-based invocation avoids shell interpretation
# Node.js pseudocode for a safer generate_types handler
# const { execFile } = require('child_process');
# const SCHEMA_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
# if (!SCHEMA_RE.test(schema)) throw new Error('invalid schema');
# execFile('supabase', ['gen', 'types', 'typescript', '--schema', schema], cb);