CVE-2026-106765

Docker MCP image filters can become shell commands

rog0x · @rog0x/mcp-docker-tools

First documented disclosure · Review checkpoint

Summary

A model-supplied image-list filter reaches a shell command without escaping.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: Researcher source tracing and public source code; no observed malicious exploitation or victim is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

handleImageList appends filter text to a command passed to child_process.execSync.

Conditions required

The MCP server is installed and enabled, and the attacker influences an executed tool argument, potentially through content read by the connected model.

Potential impact

Code runs with the MCP process’s privileges and can expose its files, credentials and Docker access.

Affected versions and configurations

1.0.1 per CNA; npm latest remains 1.0.1.

Fix and mitigation status

No fixed published version verified; the disclosure issue remains open without a response.

Practical next steps

Disable the affected tool until patched. Replace shell interpolation with argument-array process execution and isolate Docker authority.

Operating lesson

A model-generated parameter is untrusted input to an operating-system boundary.

Evidence and limits

September 23 public issue names both sibling packages; October 23 is CVE publication. This ID concerns docker_image_list, not the sibling Git package. Researcher JSON contains stale reserved-state metadata; the authoritative CNA is published. November 3 technical detail does not reset disclosure.

Sources