CVE-2026-23882 HIGH

CVE-2026-23882: Blinko: Admin RCE - MCP Server Command Injection

Vendor Blinkospace
Product blinko
Weakness CWE-78
Published March 23, 2026
Last update March 24, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP (Model Context Protocol) server creation function allows specifying arbitrary commands and arguments, which are executed when testing the connection. This issue has been patched in version 1.8.4.

Key dates

02Disclosure timeline

March 23, 2026 CVE published
March 24, 2026 Record updated