Issues

• [SECURITY] CVE-2026-41905 — Desktop Commander read_file isUrl fetches any destination without validation (SSRF)

  wonderwhy-er/DesktopCommanderMCP#1015 · Filter by author ShieldPi1 opened on Nov 8, 2026

• [SECURITY] CVE-2026-41907 — Desktop Commander node:local and shell argument bypass blockedCommands (arbitrary code execution)

  wonderwhy-er/DesktopCommanderMCP#1016 · Filter by author ShieldPi1 opened on Nov 8, 2026

• [SECURITY] CVE-2026-41906 — Desktop Commander empty blockedCommands disables all command filtering (fail-open)

  wonderwhy-er/DesktopCommanderMCP#1017 · Filter by author ShieldPi1 opened on Nov 8, 2026

• Every tool call emits [FEEDBACK DEBUG] console.log lines as MCP notifications/message (level info); no way to turn them down (logging/setLevel not handled)

  wonderwhy-er/DesktopCommanderMCP#1014 · Filter by author polyaklaci opened on Nov 8, 2026

• BoSS

  wonderwhy-er/DesktopCommanderMCP#1012 · Filter by author saytfa36pa-web opened on Nov 8, 2026

• สายฟ้า

  wonderwhy-er/DesktopCommanderMCP#1011 · Filter by author saytfa36pa-web opened on Nov 7, 2026

• สายฟ้า

  wonderwhy-er/DesktopCommanderMCP#1010 · Filter by author saytfa36pa-web opened on Nov 7, 2026

• นาย ฟ้า

  wonderwhy-er/DesktopCommanderMCP#1009 · Filter by author saytfa36pa-web opened on Nov 7, 2026

• Falla al iniciar secion microsoft

  wonderwhy-er/DesktopCommanderMCP#997 · Filter by author cristhianmoncada288-ship-it opened on Nov 5, 2026

• Proposal: support Zod 4 with native tool input-schema conversion (downstream override reproduction)

  wonderwhy-er/DesktopCommanderMCP#987 · Filter by author MFJG-dev opened on Nov 3, 2026

• Feature request: add a safe move-to-Recycle-Bin tool for remote file cleanup

  wonderwhy-er/DesktopCommanderMCP#985 · Filter by author stylessalam-hub opened on Nov 2, 2026

• macOS XProtect terminates remote session during restricted Claude review launch (0.3.1)

  wonderwhy-er/DesktopCommanderMCP#983 · Filter by author CampaignBoss opened on Nov 2, 2026

• write_file schema still advertises mode default 'rewrite' although omitted mode is rejected since v0.2.44

  wonderwhy-er/DesktopCommanderMCP#981 · Filter by author Poesiaerestu opened on Nov 1, 2026

• [Bug] Newline-separated statements bypass blockedCommands validation

  wonderwhy-er/DesktopCommanderMCP#976 · Filter by author amine-bradji opened on Oct 31, 2026

• Remote web dashboard blocked by Kaspersky — HEUR.Script.Generic (October 27–28, 2026)

  wonderwhy-er/DesktopCommanderMCP#961 · Filter by author niltonmaciel opened on Oct 29, 2026

• Windows Smart App Control blocks Remote Desktop Commander reconnect

  wonderwhy-er/DesktopCommanderMCP#959 · Filter by author rhodusjim-gif opened on Oct 28, 2026

• extractCommands separator set omits newline — advisory blocklist misses commands after a line break

  wonderwhy-er/DesktopCommanderMCP#957 · Filter by author anir0y opened on Oct 28, 2026

• edit_block fails with EBADF (and write_file ENOENT via plugin) on Windows; reads and shell writes work

  wonderwhy-er/DesktopCommanderMCP#956 · Filter by author jmstudio14 opened on Oct 28, 2026

• start_process tool description includes the container hostname, so description hashes differ between runs

  wonderwhy-er/DesktopCommanderMCP#935 · Filter by author antoniogm82 opened on Oct 27, 2026
  2

• Command blocklist bypass via newline in start_process (extractCommands misses \n/\r)

  wonderwhy-er/DesktopCommanderMCP#933 · Filter by author kaii-k opened on Oct 26, 2026

• Windows device-connector (MasterPackager) updater polls WMI every few seconds -> WmiPrvSE ~471 PF/s, 4.2% CPU

  wonderwhy-er/DesktopCommanderMCP#926 · Filter by author m1nuzz opened on Oct 25, 2026

• 0.3.1: authenticated private Realtime channel times out while raw Supabase WebSocket/heartbeat works

  wonderwhy-er/DesktopCommanderMCP#925 · Filter by author M-raeisi opened on Oct 25, 2026
  3

• Read-only capability determination — active remote connection to loaded local executor identity

  wonderwhy-er/DesktopCommanderMCP#922 · Filter by author fadikaouk007 opened on Oct 24, 2026
  1

• Remote: headless device enrollment (revocable per-device enrollment token or device-approval API)

  wonderwhy-er/DesktopCommanderMCP#892 · Filter by author spencer-shadley opened on Oct 22, 2026

• Remote MCP multi-account discovery can replace account-aware tool schema with account-unaware schema

  wonderwhy-er/DesktopCommanderMCP#891 · Filter by author xJamesCZ opened on Oct 22, 2026