What happened
NVD published CVE-2026-19041 (CVSS 6.3, Medium) on August 6, 2026, describing an OS command injection vulnerability in MissionSquad's mcp-api package installation controller.
Why it matters
An MCP-API server that installs npm packages on behalf of an agent is a high-value target — command injection here gives a remote attacker code execution on the MCP host, potentially compromising every agent connected to that server.
Attack vector
The packageService.installPackage function in the NPM Package Version Handler fails to sanitize input, allowing an attacker to inject and execute arbitrary OS commands remotely via crafted package/version parameters.
Affected systems
MissionSquad mcp-api ≤ 1.11.8
Mitigation
Upgrade to a patched mcp-api release.