All vulnerabilities

CVE-2026-81097

rails-mcp-server 1.4.0 through 1.6.0: OS command execution via execute_ruby PTY escape

highCVSS 8.6CWE-78

Vendor

rails-mcp-server

Package

rails-mcp-server rubygems

Affected

>= 1.4.0, <= 1.6.0

Disclosed

2026-08-27

Credit

Avishai Gonen

command-injectionmcp

Published advisory