@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module
Date: 2026-05
Affected: npm/@profullstack/mcp-server
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Critical
CWE: CWE-78
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

<html> <body> <!--StartFragment--><html><head></head><body><h1>Security Advisory: OS Command Injection in <code>profullstack/mcp-server</code> <code>domain_lookup</code> Module</h1> Field | Value -- | -- Project | profullstack/mcp-server Repository | https://github.com/profullstack/mcp-server Affected Commit | 2e8ea913573610667ad54e31dba2e8198ebf7cf9 Affected Module | mcp_modules/domain_lookup Affected Endpoints | POST /domain-lookup/check, POST /domain-lookup/bulk Vulnerability Type | CWE-78: OS Command Injection CVSS 3.1 Score | 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Authentication Required | None Default Network Exposure | Bind address 0.0.0.0, no global authentication middleware Validated | 2026-04-21 (initial), 2026-04-28 (re-confirmed) <hr> <h2>Summary</h2> <p>The <code>domain_lookup</code> module assembles a shell command string by concatenating user-controlled input (<code>domains</code> / <code>keywords</code>) and passes it to <code>execAsync()</code>. Both HTTP endpoints reach the same sink. Because there is no argument quoting, escaping, or allowlist — and no authentication on the server — an unauthenticated remote attacker can execute arbitrary OS commands as the server process.</p> <hr> <h2>Affected Code</h2> <ul> <li><code>index.js:27</code> — server binds to <code>0.0.0.0</code>, no global auth middleware.</li> <li><code>mcp_modules/domain_lookup/index.js:52</code> — registers <code>POST /domain-lookup/check</code>.</li> <li><code>mcp_modules/


Mitigations:

Architectural layers (MAESTRO):