What happened
NVD published CVE-2026-19263 (CVSS 7.3, High) on August 8, 2026, describing unsanitized command/args handling in mcp-bridge-api's Servers Endpoint leading to remote command injection.
Why it matters
Another instance of the recurring MCP-server command-injection pattern where LLM-agent-controlled tool parameters flow unsanitized into shell execution; low broad-deployment footprint keeps this at Tier C but the underlying bug class is a widespread risk across MCP bridge implementations.
Attack vector
The mcp-bridge.js Servers Endpoint fails to sanitize the command/args parameters, allowing a remote caller to inject and execute arbitrary OS commands.
Affected systems
INQUIRELAB mcp-bridge-api (up to commit b30a82aa1d1d1139e0de846c41c8aadee6e06114)
Mitigation
No fixed version available at time of publication (rolling release); restrict network access to the Servers Endpoint and monitor upstream repository for a patch.