{"metadata": {"vulnerability": "cve-2026-108953", "count": 14, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-04T00:00:00Z", "date_only": false, "value": "2026-10-04T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-108953", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-11T19:04:35.850Z", "date_only": false, "value": "2026-10-11T19:04:35.850Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-108953", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T12:13:05.422Z", "date_only": false, "value": "2026-10-12T12:13:05.422Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-108953", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T12:13:05.422Z", "date_only": false, "value": "2026-10-12T12:13:05.422Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-108953", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T12:37:59.592Z", "date_only": false, "value": "2026-10-12T12:37:59.592760Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117427973591059454", "record": "CVE-2026-108953", "field": "creation_timestamp", "uuid": "f5fa63e1-7bde-4392-b76f-1c1353c25c31", "content": "CVE-2026-108953 mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into execute_command arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run forbidden commands as the server user without approval.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108953https://github.com/cfdude/mac-shell-mcp/issues/45https://github.com/cfdude/mac-shell-mcp/commit/932ce733cde07bb30b1f186303e6692dbb5d087ahttps://github.com/cfdude/mac-shell-mcp/blob/1c1708201abb7a18c83075e1bf933e7a92cbeb9f/src/services/command-service.ts#L257-L340https://github.com/cfdude/mac-shell-mcphttps://www.vulncheck.com/advisories/mac-shell-mcp-before-2.0.0-os-command-injection-via-execute-command-arguments#cfdude #mac-shell-mcp#CVE_2026_108953#bot", "url": "https://infosec.exchange/users/cve/statuses/117427973591059454"}, {"timestamp": "2026-10-12T13:17:28Z", "date_only": false, "value": "2026-10-12T13:17:28Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FFV7-8X5H-5W7R", "record": "GHSA-FFV7-8X5H-5W7R", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T13:17:28.307Z", "date_only": false, "value": "2026-10-12T13:17:28.307", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108953", "record": "FKIE_CVE-2026-108953", "field": "published"}, {"timestamp": "2026-10-12T15:32:12Z", "date_only": false, "value": "2026-10-12T15:32:12Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FFV7-8X5H-5W7R", "record": "GHSA-FFV7-8X5H-5W7R", "field": "published"}, {"timestamp": "2026-10-12T15:32:13Z", "date_only": false, "value": "2026-10-12T15:32:13Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FFV7-8X5H-5W7R", "record": "GHSA-FFV7-8X5H-5W7R", "field": "modified"}, {"timestamp": "2026-10-13T16:40:52.381Z", "date_only": false, "value": "2026-10-13T16:40:52.381818Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-108953", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T16:40:52.381Z", "date_only": false, "value": "2026-10-13T16:40:52.381818Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108953", "record": "FKIE_CVE-2026-108953", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T16:58:27.456Z", "date_only": false, "value": "2026-10-13T16:58:27.456Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-108953", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T16:58:27.456Z", "date_only": false, "value": "2026-10-13T16:58:27.456Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-108953", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T19:18:44.867Z", "date_only": false, "value": "2026-10-16T19:18:44.867", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108953", "record": "FKIE_CVE-2026-108953", "field": "lastModified"}]}