CVE-2026-23882CWE-78

Blinko: Admin RCE - MCP Server Command Injection

High · published March 23, 2026

CVSS v4.0
8.6
EPSS
0%
Percentile
29.5
In the wild
Unconfirmed
What it is

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP (Model Context Protocol) server creation function allows specifying arbitrary commands and arguments, which are executed when testing the connection. This issue has been patched in version 1.8.4.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00368 · 29.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-23T20:52Z
EPSS history
Timeline
  • 23 MAR 20:52Z
    Blinko: Admin RCE - MCP Server Command Injection
    cvelistv5