CVE-2026-7064CWE-77CWE-78command-injection

CVE-2026-7064

High · published April 27, 2026

CVSS v3.1
7.3
EPSS
3%
Percentile
85.5
In the wild
Unconfirmed
What it is

A flaw has been found in AgentDeskAI browser-tools-mcp up to 1.2.0. This issue affects some unknown processing of the file browser-tools-server/browser-connector.ts. Executing a manipulation can lead to os command injection. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 2.0.0 is capable of addressing this issue. It is recommended to upgrade the affected component.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02643 · 85.5th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-04-27T03:16Z
References (10)
https://github.com/AgentDeskAI/browser-tools-mcp/ · [email protected]https://github.com/AgentDeskAI/browser-tools-mcp/issues/224 · [email protected]https://github.com/AgentDeskAI/browser-tools-mcp/issues/232 · [email protected]https://github.com/AgentDeskAI/browser-tools-mcp/releases/tag/v2.0.0 · [email protected]https://github.com/AgentDeskAI/browser-tools-mcp/security/advisories/GHSA-xvrv-w8pg-f25f · [email protected]https://vuldb.com/cve/CVE-2026-7064 · [email protected]https://vuldb.com/submit/798616 · [email protected]https://vuldb.com/submit/961874 · [email protected]https://vuldb.com/vuln/359639 · [email protected]https://vuldb.com/vuln/359639/cti · [email protected]
EPSS history
Timeline
  • 26 APR 22:45Z
    AgentDeskAI browser-tools-mcp browser-connector.ts os command injection
    cvelistv5