CVE-2026-113378: Disputed mcp-ripgrep command injection report

Tracking: CVE-2026-113378
Severity: Medium (CVSS 3.1: 5.3)

Who is affected

mcp-ripgrep through 0.4.0. The reported vector is local and requires low privileges; do not treat this as an unauthenticated network exploit.

How the attack works

The report identifies the fileType argument in AdvancedSearch in src/index.ts. Other arguments pass through escapeShellArg, while this value can enter a shell command without equivalent escaping. An attacker who controls that input could inject commands with the MCP process's privileges.

The CVE record explicitly says the vulnerability's existence is disputed. The maintainer points to documented warnings about shell execution. That disagreement is material when deciding whether the component meets your security requirements.

What to do

1. Check whether untrusted callers or agent-generated input can control fileType in your deployment.
2. Restrict the tool to trusted input and run it with limited filesystem and credential access while reviewing the maintainer's position.
3. Track the linked disclosure for a resolution or patch. No fixed release is identified in the reviewed record.

Scope and limits

A public proof of concept is referenced. The dispute and local attack prerequisites should accompany any internal escalation.

Sources

• Original advisory or incident report