CVE-2026-7642 | pskill9 website-downloader up to 0.1.0 MCP Interface src/index.ts download_website outputPath os command injection

A vulnerability, which was classified as critical, has been found in pskill9 website-downloader up to 0.1.0. This affects the function download_website of the file src/index.ts of the component MCP Interface. Performing a manipulation of the argument outputPath results in os command injection.

This vulnerability was named CVE-2026-7642. The attack may be initiated remotely. In addition, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.