Two CVEs published for MissionSquad mcp-api, a command injection and an SSRF, each fixed in a point release
VulDB assigned two CVEs for MissionSquad's mcp-api, one a command injection in its NPM package version handler and one an SSRF in its dynamic client registration code. Both records state a fixed version. VulDB supplied scores across three CVSS versions, which disagree substantially.
NVD published two VulDB-assigned CVEs for MissionSquad mcp-api on August 6. No separate vendor advisory was found; VulDB via NVD is the disclosure surface.
CVE-2026-19041 (published 2026-08-06T14:16:36.223) describes a flaw in
this.packageService.installPackage in src/controllers/packages.ts,
remotely reachable, CWE-74 and CWE-77. VulDB scores: CVSS v3.1 6.3
MEDIUM (primary), CVSS v4.0 2.1 LOW, CVSS v2.0 6.5 MEDIUM. Affected:
MissionSquad mcp-api up to 1.11.8; upgrading to 1.11.9 is stated as
sufficient.
CVE-2026-19040 (published 2026-08-06T14:16:36.043) describes SSRF in an
unspecified function of src/services/dcrClients.ts, CWE-918. VulDB
scores use the same three-version spread (v4.0 2.1, v3.1 6.3, v2.0
6.5). Affected up to 1.11.9; upgrading to 1.11.10 is stated as
sufficient. References include release tag v1.11.10 and commit
f068ab4.
The v3.1 and v4.0 scores diverge by more than four points on both CVEs, so any quoted number should name its CVSS version.
How was this verified, and what are the sources?
Published · confidence 0.85.