CVE-2026-10691: ReDoS Vulnerability in DesktopCommanderMCP Search Manager

Technical summary

CVE-2026-10691 is a ReDoS (Regular Expression Denial of Service) vulnerability affecting the start_search function in src/search-manager.ts of DesktopCommanderMCP. The vulnerability stems from improper handling of SearchResult[] arguments, leading to catastrophic backtracking in regex evaluation. An authenticated attacker can manipulate search result parameters to cause excessive CPU consumption and application unavailability. The CVSS 3.1 score of 4.3 (MEDIUM) reflects network accessibility but requires prior authentication and impacts only availability.

Business impact

This vulnerability enables authenticated users to disrupt service availability through resource exhaustion attacks. While the attack requires valid credentials, it can be weaponized to create operational disruptions, degrade application responsiveness, or cause temporary outages. Organizations relying on DesktopCommanderMCP for critical search operations may experience service interruptions, though confidentiality and integrity remain unaffected. The public availability of exploit code increases likelihood of opportunistic attacks.

Affected systems

wonderwhy-er DesktopCommanderMCP versions up to and including 0.2.38 are affected. The vulnerability is resolved in version 0.2.39. Any deployment using versions prior to 0.2.39 should be considered at risk, particularly if accessible to multiple internal users or untrusted authenticated accounts.

Exploitability

This vulnerability has moderate exploitability. It requires network access and valid authentication credentials, but no special privileges. The attack vector is straightforward—an authenticated user supplies crafted search parameters that trigger regex backtracking. Public exploit code is available, lowering the barrier to entry for attackers. However, the necessity of authentication and the straightforward nature of detection (observable CPU/performance impact) limit widespread abuse.

Remediation

Upgrade DesktopCommanderMCP to version 0.2.39 or later, which includes commit 4ce845f8749b6a159b57b38dcc3357f7222a8078 resolving the regex complexity issue. Organizations should prioritize this upgrade for systems exposed to untrusted authenticated users. Until patching is complete, implement input validation on search parameters and monitor for unusually high CPU consumption during search operations.

Patch guidance

Update to DesktopCommanderMCP version 0.2.39 immediately. The patch directly addresses the inefficient regex in the search-manager component. Verify the applied patch includes commit 4ce845f8749b6a159b57b38dcc3357f7222a8078 to confirm proper remediation. Test search functionality after upgrade to ensure no regression. For environments where immediate upgrade is not feasible, temporarily restrict access to the search function or apply compensating controls such as regex timeout policies at the application or system level.

Detection guidance

Monitor for indicators of exploitation: sustained elevated CPU usage coinciding with search API calls, repeated search requests with unusual parameter patterns, or performance degradation specifically in the search-manager component. Check application logs for high-frequency search_start events or malformed SearchResult[] inputs. Network monitoring can detect patterns of repeated search requests from authenticated sessions. Consider alerting on regex timeout exceptions if your runtime supports them. Post-patch, validation testing should confirm regex performance returns to baseline.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. The MEDIUM severity reflects genuine availability risk, but authentication requirements and lack of KEV designation limit its criticality tier. Organizations should schedule patching within 2–4 weeks, prioritizing systems with high-availability requirements or exposure to lower-trust user bases. The public exploit code justifies accelerating from standard timelines but does not mandate immediate action for well-segmented environments.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), and requirement for low privileges (PR:L). No user interaction is required (UI:N), and the impact is scoped to availability (A:L). The score correctly omits confidentiality and integrity concerns. The score is proportionate—this is a legitimate availability risk that does not rise to high severity due to authentication and denial-of-service scope limitations.

Frequently asked questions