External risk intelligence

MCP Watch Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-66401

The vulnerability exists in a security scanner tool intended for Model Context Protocol (MCP) servers. While such tools are often used by developers or in internal CI/CD pipelines to audit infrastructure, they may be integrated into automated scanning services or networked environments where they process untrusted inputs, making internet reachability possible depending on the specific deployment.

OS Command Injection

Kapilduraphe Mcp Watch

0.1.2 and earlier

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

MCP Watch, a security scanning tool for Model Context Protocol (MCP) servers, has a critical vulnerability that could allow an attacker to run unauthorized commands on the host machine. This occurs because user-provided input is not properly secured before being processed by the system. The main concern is determining if your deployed instances of this tool are exposed to this risk.

Input flaws allow unintended command execution.
Critical flaw in security scanning software.
Verify if this tool is in use and exposed.

Attack Path

How an attacker could exploit the issue

An attacker can execute arbitrary commands on the host machine by providing a specially crafted URL to the `cloneRepo` method. This vulnerability arises because the application passes the user-supplied `githubUrl` directly to a system shell without proper sanitization. When successfully triggered, this can lead to the execution of malicious code, compromising the integrity and availability of the affected system.

No authentication required for access.
Input to `cloneRepo` method is unsanitized.
Arbitrary command execution on the host.

Live Threat

Current exploitation, exposure, and threat context

An attacker could execute arbitrary commands on the host system running MCP Watch when this vulnerability is present and the affected method is utilized with a crafted URL. This could impact the integrity and availability of the host system and its services.

Host system commands could be executed.
Malicious URLs could be processed.
Compromise of host and services may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this critical command injection vulnerability in MCP Watch. The first practical step is to identify all instances of MCP Watch, confirm their reachability and business criticality, and then assign ownership to the accountable team for remediation planning.

Identify accountable application owners.
Verify external reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MCP Watch?

MCP Watch is a security tool designed to scan and audit Model Context Protocol (MCP) servers. Developers and security engineers use it to verify the integrity of these server configurations. It is typically deployed within development environments or CI/CD pipelines where it interacts with repository data to monitor MCP infrastructure.

How does CVE-2025-66401 work?

This vulnerability is a Command Injection, classified as CWE-78. It happens because the application takes a URL provided by a user and sends it directly to the underlying system shell without checking it first. Because the software does not sanitize this input, an attacker can attach malicious commands to the URL, tricking the system into running those commands with the tool's privileges.

When does this vulnerability trigger?

The flaw triggers only when the application's cloneRepo method processes a malicious input. Simply having the software installed or idle does not trigger the vulnerability. It requires the tool to actively receive and attempt to process a specially crafted githubUrl containing shell metacharacters. If the method is not called, or if the input is a standard, non-malicious URL, the command injection does not occur.

Is my instance of MCP Watch at risk?

Halo Surface Signal indicates that your risk depends on how you have deployed the tool. While many instances are used internally, some might be exposed to the internet if they are part of automated services or public-facing scanning infrastructure. If your instance can be reached by untrusted sources or processes external inputs directly, it faces a higher likelihood of being targeted.

What should I do to address this issue?

Start by auditing your environment to locate all running instances of MCP Watch. Confirm which versions are in use and determine if they are reachable from untrusted networks. Once identified, contact the teams responsible for these systems to plan for updates. Prioritize instances that process external inputs or have high business criticality to minimize potential impact.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.