Search results

Undisclosed prompt-injection payload + auto-opened browser tab; package was never manually installed

Status: Open.

#543 In wonderwhy-er/DesktopCommanderMCP;

· jecanore opened on Jul 8, 2026

write_file's default mode ("rewrite") silently overwrites existing files — dangerous default for LLM agent use

Status: Open.

#541 In wonderwhy-er/DesktopCommanderMCP;

· PHeitsch opened on Jul 7, 2026

write_file hangs and never reaches the tool handler when called from the claude.ai remote client (v0.2.43 DXT)

Status: Open.

#532 In wonderwhy-er/DesktopCommanderMCP;

· vinsonconsulting opened on Jul 1, 2026

write_file should auto-create missing parent directories (or add a recursive option)

Status: Open.

#525 In wonderwhy-er/DesktopCommanderMCP;

· hl9020 opened on Jun 25, 2026

read_file for images: structuredContent.content (base64) is dumped as text by Claude Code CLI — large context bloat

Status: Open.

#521 In wonderwhy-er/DesktopCommanderMCP;

· carrotRakko opened on Jun 23, 2026

MS Defender flags as remote shell

Status: Open.

#511 In wonderwhy-er/DesktopCommanderMCP;

· mdunc opened on Jun 14, 2026

initialize handshake intermittently exceeds 60s host timeout — blocked by feature-flag network refresh; not gated by telemetryEnabled

Status: Open.

#510 In wonderwhy-er/DesktopCommanderMCP;

· JEM-Fizbit opened on Jun 14, 2026

Resolve spawned executables by absolute path

Status: Open.

#509 In wonderwhy-er/DesktopCommanderMCP;

· quintessence-proof opened on Jun 10, 2026

Restrict markdown link navigation to safe URI schemes

Status: Open.

#508 In wonderwhy-er/DesktopCommanderMCP;

· quintessence-proof opened on Jun 10, 2026

Add Content-Security-Policy to the HTML-preview iframe

Status: Open.

#507 In wonderwhy-er/DesktopCommanderMCP;

· quintessence-proof opened on Jun 10, 2026

Redact sensitive values and restrict tool-call log permissions

Status: Open.

#506 In wonderwhy-er/DesktopCommanderMCP;

· quintessence-proof opened on Jun 10, 2026

Flush pending telemetry before process exit

Status: Open.

#505 In wonderwhy-er/DesktopCommanderMCP;

· quintessence-proof opened on Jun 10, 2026