CVE-2026-116102: QuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-26
Weakness: CWE-77

Description

A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py. This manipulation of the argument project_name causes os command injection. It is possible to initiate the attack remotely.

Affected products

QuantGeekDev docker-mcp: 0.1.0, 0.2.0

References

https://vuldb.com/cve/CVE-2026-116102
https://vuldb.com/submit/1002791
https://vuldb.com/vuln/426170
https://vuldb.com/vuln/426170/cti

Get alerted when CVE-2026-116102 or the next vulnerability affects your stack