Executive brief
godot-mcp is a Model Context Protocol server that integrates the Godot game engine with AI tools, allowing remote operation of scene and sprite management. A command injection flaw in how it processes project paths allows an attacker to execute arbitrary system commands with the privileges of the MCP server process, potentially leading to full system compromise or data theft.
Technical details
godot-mcp contains a CWE-78 OS command injection vulnerability in the executeOperation function, which passes unsanitized user-supplied projectPath parameters directly to exec(), a function that spawns a shell. An attacker can inject shell metacharacters (e.g., $(command) or &calc) through any operation accepting projectPath, including create_scene, add_node, and load_sprite. The attack requires local access or interaction from a user, but grants full remote code execution with server privileges. The vulnerability is fixed in version 0.1.1 by switching from exec() to execFile(), which does not invoke a shell and prevents metacharacter interpretation.
Affected products
- Coding-Solo godot-mcp < 0.1.1
Timeline
- 2026-02-04: disclosed
- 2026-02-04: patched: version 0.1.1