CVE-2025-61489

Medium · 6.5

CVSS

6.5

EPSS

1.0%

Published

Jan 7, 2026

CISA due date

—

The record

A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows attackers to execute arbitrary commands via supplying a crafted command string.

Affected packages

Ecosystem	Package	Introduced	Fixed