CVE-2025-11491: Wonderwhy-Er Desktopcommandermcp

Critical severity, CVSS 9.8. EPSS: 4.3% chance of exploitation in the next 30 days.

A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Affected products

• Wonderwhy-Er Desktopcommandermcp: up to and including 0.2.13

Published 2025-10-08. Last modified 2026-10-08.