EUVD-2026-54781
GHSA-rrf2-j3h9-99wg
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with low privilege matches git hooks invocation context; unchanged scope and low C/I/A reflect limited process permissions and no lateral movement.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolearn/GitHooksManager.ts of the component llm_memory_mcp. Executing a manipulation of the argument hash can lead to command injection. The attack is restricted to local execution. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Command injection in andreahaku llm_memory_mcp allows local attackers with limited privileges to execute arbitrary OS commands by manipulating the hash argument passed to the auto.capture function in GitHooksManager.ts. All commits up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0 are affected, and a proof-of-concept is indicated as available via the CVSS 4.0 E:P enrichment. No patch has been released, and the project maintainer has not responded to the coordinated disclosure reported via GitHub issue.
Technical ContextAI
The vulnerable component is src/autolearn/GitHooksManager.ts (CPE: cpe:2.3:a:andreahaku:llm_memory_mcp:*:*:*:*:*:*:*:*), an autolearn module within an MCP (Model Context Protocol) server designed for LLM memory management via Git hooks. The auto.capture function accepts a hash parameter - almost certainly a Git commit hash intended for shell invocation - without sufficient neutralization of special characters. CWE-77 (Improper Neutralization of Special Elements used in a Command) covers exactly this pattern: user-controlled input embedded directly into a constructed shell command string, enabling injection of shell metacharacters or subshell expressions. In Node.js/TypeScript codebases, this typically manifests as use of child_process.exec() with string interpolation rather than the safer execFile() with argument arrays, which would prevent shell interpretation entirely.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer has not responded to the disclosure per GitHub issue #21 (https://github.com/andreahaku/llm_memory_mcp/issues/21). The most effective compensating control is to replace shell string interpolation in src/autolearn/GitHooksManager.ts with parameterized subprocess execution - specifically, replacing any child_process.exec() call that embeds the hash argument into a command string with child_process.execFile() using a structured argument array, which bypasses shell interpretation entirely and eliminates the injection surface without degrading functionality. As an operational workaround, restrict local system access to trusted users only, since the local attack vector (AV:L) means the vulnerability is not exploitable remotely. Monitor the GitHub repository for an upstream commit that addresses the issue and pin deployments to a verified safe revision once available.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today