Is there a public PoC exploit available for CVE-2026-5619?

Yes, a public proof-of-concept exploit is available for CVE-2026-5619. Prioritise patching immediately. EPSS: 0.3%.

Mcp Summarization Functions CVE-2026-5619

Q: What is the CVSS score of CVE-2026-5619?

CVE-2026-5619 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-19166 LOW

OS Command Injection (CWE-78)

2026-04-06 VulDB

Command Injection Mcp Summarization Functions

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 04:45 euvd

EUVD-2026-19166

Analysis Generated

Apr 06, 2026 - 04:45 vuln.today

CVE Published

Apr 06, 2026 - 03:45 nvd

MEDIUM 4.8

DescriptionCVE.org

A flaw has been found in Braffolk mcp-summarization-functions up to 0.1.5. This impacts an unknown function of the file src/server/mcp-server.ts of the component summarize_command. Executing a manipulation of the argument command can lead to os command injection. The attack requires local access. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

OS command injection in Braffolk mcp-summarization-functions through version 0.1.5 allows local attackers with user-level privileges to execute arbitrary system commands by manipulating the command argument in the summarize_command function. The vulnerability affects the src/server/mcp-server.ts component and requires local access; publicly available exploit code exists, and the vendor has not responded to disclosure attempts.

Technical ContextAI

The vulnerability stems from unsafe handling of user-supplied input in the summarize_command function within the Model Context Protocol (MCP) server implementation. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates the root cause is inadequate input validation or sanitization before command execution. The affected component mcp-summarization-functions is a Node.js-based MCP server that processes summarization requests; the flaw occurs when the command argument is passed to OS command execution without proper escaping or parameterization. The CPE cpe:2.3:a:braffolk:mcp-summarization-functions:*:*:*:*:*:*:*:* indicates all versions up to and including 0.1.5 are affected.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations should immediately audit their use of mcp-summarization-functions and consider discontinuing deployment until a patched version becomes available. Interim mitigations include restricting mcp-summarization-functions execution to dedicated, isolated accounts with minimal privileges; implementing OS-level controls (e.g., AppArmor, SELinux) to restrict command execution capabilities; and disabling or removing summarize_command functionality if not actively required. Monitor the Braffolk project repository and VulDB (https://vuldb.com/vuln/355409) for updates. For organizations unable to upgrade, running mcp-summarization-functions in a restricted container or virtual environment with minimal system access is recommended.