HIGH7.8npmGHSA-8jx2-rhfh-q928· CVE-2026-25546godot-mcp has Command Injection via unsanitized projectPathModified: 2/5/2026