GitHub Kanban MCP Server EUVD-2026-109970

Requires a deployed github-kanban-mcp-server at version 0.4.0 or earlier and invocation of the handleListIssues function (src/handlers/issue-handlers.ts) with attacker-influenced values in the state or labels arguments, which flow into an OS command (CWE-78). The CVSS UI:P metric indicates passive user interaction is needed - the operator or driving agent must trigger the issue-listing operation for the injected input to execute; it is not a fully autonomous remote trigger. The precise path by which an external attacker controls state/labels is not described in the available sources. Limiting factors: the product is a niche, low-adoption MCP server, only versions up to 0.4.0 are affected (fixed in 0.4.1), and exploitation depends on the attacker being able to place malicious shell metacharacters into the state/labels parameters reaching the tool.

Signals are consistent and point to a moderate, non-urgent priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) describes a network-reachable, low-complexity flaw with no privileges required but requiring passive user interaction, scored 5.3 (medium) with impacts rated Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L). The vuln.today decision label is 'this_month' - meaningful but explicitly not act_now/emergency. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit was identified in the input, so there is no evidence of active or at-scale exploitation. One point of tension: CWE-78 OS command injection typically yields full command execution on the host, which would normally justify High rather than Low impact metrics; the vendor's Low ratings likely reflect a constrained MCP deployment context, but this discrepancy should be verified against the actual sink in handleListIssues. Overall this reads as a genuine but lower-tier issue - patch on a normal cadence rather than treat as an emergency - and a definitive EPSS/real-world-risk read is limited because EPSS is absent from the data.

An attacker who can influence the state or labels arguments passed to the handleListIssues tool (for example through crafted input reaching the MCP client, or attacker-controlled data the operator lists) supplies shell metacharacters that are passed into an OS command, achieving command injection on the host running the MCP server. Exploitation requires the operator or agent to actually invoke the issue-listing operation, consistent with UI:P. No public exploit identified at time of analysis.