https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-11491.htmlhttps://patchthecve.com/cve/CVE-2025-11491.htmlThu, 08 Oct 2026 13:10:00 +0000MEDIUM 6.3: A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made publihttps://patchthecve.com/cve/CVE-2025-11490.htmlhttps://patchthecve.com/cve/CVE-2025-11490.htmlThu, 08 Oct 2026 13:10:00 +0000MEDIUM 6.3: A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from remotehttps://patchthecve.com/cve/CVE-2025-11489.htmlhttps://patchthecve.com/cve/CVE-2025-11489.htmlThu, 08 Oct 2026 13:10:00 +0000MEDIUM 4.5: A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performed from a local environment. The attack's