Skip to content
OpenAdvisories

Package · npm

mcp-watch

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.8
    CVE-2025-66401

    MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL

    MCP Watch is a comprehensive security scanner for Model Context Protocol (MCP) servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command Injection vulnerability in the cloneRepo method. The application passes the user-supplied githubUrl …

    kapilduraphe mcp-watch mcp-watch npm