CVE-2026-23882 — Blinko: Admin RCE - MCP Server Command Injection
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP (Model Context Protocol) server creation function allows specifying arbitrary commands and argu…
Published: 2026-03-23 · CVSS: 8.6 · CVSS 4.0
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP (Model Context Protocol) server creation function allows specifying arbitrary commands and arguments, which are executed when testing the connection. This issue has been patched in version 1.8.4.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7