What happened
An OS command injection in docker-mcp's _build_windows_command allows code execution when building the Docker command from project_name. CVSS 6.3, published 2026-10-26.
Why it matters
Docker is a common agent tool; an MCP server that constructs shell commands from tool arguments turns an agent tool call into a host command-execution primitive on Windows.
Attack vector
The project_name argument is passed into a shell command on Windows without safe quoting, so a malicious or agent-supplied project_name injects OS commands and executes code remotely.
Affected systems
QuantGeekDev docker-mcp 0.1.0 / 0.2.0 (docker_executor.py _build_windows_command).
Mitigation
Upgrade to a fixed version; validate/quotes project_name and avoid passing untrusted values to the Docker MCP executor.