EUVD-2026-29159
GHSA-64vr-4gr2-m642
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka view) in the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGE_BASE_URL.
AnalysisAI
Remote code execution in automagik-genie 2.5.27 MCP Server occurs when processing transcripts from attacker-controlled external FORGE_BASE_URL endpoints. Exploitation chains command injection in the readTranscriptFromCommit function's view_task parameter to execute arbitrary system commands on the server. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all automagik-genie 2.5.27 deployments and document which systems process external or untrusted transcript sources; isolate affected servers from production networks if possible. Within 7 days: Implement network controls to restrict FORGE_BASE_URL endpoint access to known-trusted sources only; monitor for suspicious transcript processing activity. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today