Coding-Solo vulnerabilities

Products

• godot-mcp 1

Latest Coding-Solo CVEs

Newest publication first

1. CVE-2026-25546 Godot MCP is vulnerable to Command Injection via unsanitized projectPath

   Published 2026-02-04

   High·CVSS 7.8

   Godot MCP is a Model Context Protocol (MCP) server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The executeOperation function passed user-controlled input (e.g., projectPath) direc...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.