A newly disclosed flaw, CVE-2026-116102, affects versions 0.1.0 and 0.2.0 of QuantGeekDev's docker-mcp project. The vulnerability sits in the _build_windows_command function inside docker_executor.py, where a crafted project_name argument lets an attacker inject and execute arbitrary OS commands, and the attack can reportedly be launched remotely without authentication. Command injection bugs like this are a reminder to treat every externally influenced argument passed into a shell call as hostile input.
// source: nvd.nist.gov ↗