CVE-2026-25546: Godot MCP Command Injection RCE Flaw

CVE-2026-25546 Overview

CVE-2026-25546 is a command injection vulnerability in Godot MCP, a Model Context Protocol (MCP) server designed for interacting with the Godot game engine. Prior to version 0.1.1, the executeOperation function passed user-controlled input (e.g., projectPath) directly to exec(), which spawns a shell. An attacker could inject shell metacharacters like $(command) or &calc to execute arbitrary commands with the privileges of the MCP server process.

Critical Impact

Remote code execution through command injection affecting multiple tools including create_scene, add_node, load_sprite, and others that accept projectPath parameter.

Affected Products

• Godot MCP versions prior to 0.1.1
• Any application utilizing vulnerable Godot MCP tools that accept projectPath parameter
• MCP server deployments with user-controlled input handling

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-25546 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25546

Vulnerability Analysis

This command injection vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command) stems from the unsafe handling of user-supplied input in the Godot MCP server. The executeOperation function directly incorporates user-controlled parameters into shell commands without proper sanitization or validation. When parameters like projectPath are passed directly to the exec() function, the underlying shell interprets special characters and metacharacters as command delimiters or substitutions.

The vulnerability enables attackers to break out of the intended command context and execute arbitrary system commands. This affects any tool within Godot MCP that processes the projectPath parameter, including create_scene, add_node, load_sprite, and other operations. The impact is particularly severe because the injected commands execute with the same privileges as the MCP server process, potentially allowing full system compromise.

Root Cause

The root cause of this vulnerability is the direct concatenation of unsanitized user input into shell command strings that are subsequently executed via exec(). The executeOperation function fails to implement proper input validation, output encoding, or parameterized command execution. Shell metacharacters such as $(...), backticks, semicolons, pipes, and ampersands are not filtered or escaped, allowing command injection through specially crafted projectPath values.

Attack Vector

The attack vector requires local access with user interaction. An attacker can exploit this vulnerability by providing a malicious projectPath value containing shell metacharacters to any of the affected tools. For example, injecting $(malicious_command) or ; malicious_command in the projectPath parameter causes the shell to interpret and execute the injected command. This could be triggered through:

• Direct API calls to Godot MCP with crafted parameters
• Manipulation of project configuration files loaded by MCP tools
• Injection through any interface that passes user input to affected operations

The vulnerability can be exploited to achieve arbitrary command execution, potentially leading to data exfiltration, lateral movement, or complete system compromise. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-25546

Indicators of Compromise

• Unexpected process spawning from the Godot MCP server process
• Unusual command-line arguments containing shell metacharacters like $(), backticks, ;, |, or &
• Anomalous network connections originating from MCP server process
• Log entries showing malformed projectPath values with special characters

Detection Strategies

• Monitor for suspicious child process creation from MCP server processes
• Implement logging and alerting on projectPath parameters containing shell metacharacters
• Deploy endpoint detection rules to identify command injection patterns in process arguments
• Review audit logs for unexpected command execution patterns correlated with Godot MCP usage

Monitoring Recommendations

• Enable enhanced process auditing to track all commands spawned by the MCP server
• Configure SIEM rules to detect shell metacharacter patterns in application logs
• Implement file integrity monitoring on critical system directories
• Set up alerts for any privilege escalation attempts following MCP server interactions

How to Mitigate CVE-2026-25546

Immediate Actions Required

• Upgrade Godot MCP to version 0.1.1 or later immediately
• Audit any existing Godot MCP deployments for signs of exploitation
• Review logs for suspicious projectPath values containing shell metacharacters
• Restrict network access to MCP server instances to trusted sources only

Patch Information

The vulnerability has been patched in Godot MCP version 0.1.1. The fix addresses the command injection issue by implementing proper input sanitization before passing values to shell execution functions. Organizations should update to the patched version immediately. For technical details on the fix, refer to the GitHub Commit and the Pull Request.

Workarounds

• Implement strict input validation on all projectPath parameters before they reach MCP tools
• Deploy web application firewalls or input filters to block shell metacharacters
• Run Godot MCP server with minimal privileges using principle of least privilege
• Consider containerizing the MCP server to limit potential impact of exploitation

# Verify installed Godot MCP version
npm list godot-mcp

# Update to patched version
npm update godot-mcp@0.1.1