AGENTSCORE-2026-0126
MCP package: @golproductions/envie
Published 9/12/2026 · 0.7.2 → 0.8.0
Confirmed by review on 2026-09-24
At least one finding below was checked in the package source and is a real vulnerability. Details and fixed versions are listed under the finding. Reviewed in source: the flagged code was located in the published package, read in context and traced from input to sink (AI-assisted), and every confirmation was re-audited independently.
@golproductions/envie updated from 0.7.2 to 0.8.0. Score changed 95/100 to 80/100 (-15). Risk: LOW to MODERATE. 1 finding.
95 → 80
Score
LOW → MODERATE
Risk
WARN
Verdict
Findings
- high command_injection: Potential command injection: shell execution with template literal inputConfirmedFile paths supplied by the model reach double-quoted shell strings in src/render.cjs, where $(...) still expands. Affects 0.8.0 to 0.8.5; fixed in 0.8.6.