CVE-2025-11490 is a medium severity (CVSS 6.3) OS command injection flaw in DesktopCommanderMCP up to version 0.2.13. The function extractBaseCommand fails to normalise absolute paths, so the command blocklist can be bypassed. No fixed version is confirmed. Sandbox the server and do not rely on its blocklist.
What's affected
- Product: DesktopCommanderMCP by wonderwhy-er, a Model Context Protocol server that lets an AI client run commands and work with files on a computer
- Affected: versions up to and including 0.2.13
- Component: src/command-manager.ts
- Fixed version: none confirmed. The vendor comment on the report says the issue is being left open for people to report real world problems
The public report explains the cause plainly. The extractBaseCommand function treats the whole input as the command name when it has no spaces, so a blocked command written with its full path does not match the blocklist entry. The reporter suggests reducing the token to its base name, for example with the Node.js path.basename function, before the comparison.
The record classifies the issue as CWE-78 (OS command injection) under CWE-77 (command injection). The CVSS score is 6.3 (MEDIUM), and the vector calls for a low privilege starting point over the network.
How to check if you're exposed
Check which version you run and where the server is reachable.
npm ls -g --depth=0 | grep -i desktop
npm ls | grep -i desktop
If you launch it through an MCP client configuration, open the client's config file and look at the command and arguments that start the server. Note the version pin, if any. Anything up to 0.2.13 is in range.
Then ask who can drive it. This tool is dangerous by design, because it exists to run commands. Look at which MCP clients, agents and users can send it requests, and whether any of them take instructions from web pages, tickets, emails or documents that outsiders can write to.
Finally, check the configured command blocklist. The weakness here concerns the blocklist, so a deployment that never relied on it for safety has a different risk profile from one that did.
What to do now
- Do not treat the command blocklist as a security boundary. Assume any command the user account can run can be reached through the tool.
- Run the server as a low privilege user, in a container or virtual machine, with no access to secrets, SSH keys or cloud credentials.
- Restrict which clients can connect, and require a human to approve commands from agents that read untrusted content.
- Check the project's GitHub repository for a release after 0.2.13 and read its notes before upgrading. No fixed version is confirmed in the sources reviewed.
- Log commands the server runs and review them. Unexpected paths or shell syntax in command strings are a signal.
- Inventory MCP servers across developer machines. They are easy to install and easy to forget.
Why it matters
Allow lists and blocklists for commands are only as good as the parsing that feeds them. Shell syntax has many ways to name the same program, and a check that compares raw strings will miss most of them. Absolute paths are the simplest case.
The vendor responded in the issue thread that in typical use an AI picks simple command names and models usually cooperate with restrictions. That is a statement about likelihood. It is not a fix, and it assumes the instructions the model receives are benign. Prompt injection, where hostile text in a web page or document steers an agent, breaks that assumption.
The record says an exploit has been disclosed. It is not in the CISA Known Exploited Vulnerabilities catalog and no source we reviewed reports attacks. The right lesson is architectural: a tool that runs commands for an AI needs isolation, because filtering will not hold on its own.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the blocklist protect me from dangerous commands?
Not reliably. The public report shows the check can be bypassed with an absolute path, and the weakness class is general to string matching on commands. Use isolation as the real control.
Is there a patched version of DesktopCommanderMCP?
No fixed version is confirmed. The vendor comment in the issue does not announce one. Check the repository for releases after 0.2.13.
Sources
- GitHub issue 218, Command Blocklist Bypass via Absolute Path
- CVE record and CVSS vector for CVE-2025-11490, published 2025-10-08
Last reviewed: 19 October 2026.
