EUVD-2026-54767
GHSA-fjwc-rc47-268g
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A and PR:L match CVSS 4.0 input; S:U and L/L/L CIA align with 4.0 SC:N/SI:N/SA:N and VC/VI/VA:L respectively.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1 mitigates this issue. This patch is called e0729dcfd3a2b1682a7bff86e7174852c03419ba. It is advisable to upgrade the affected component.
AnalysisAI
Command injection in Kirachon context-engine up to version 1.9.0 allows adjacent authenticated attackers to execute arbitrary OS commands through the review-git-diff MCP endpoint. The root cause is the execGitCommand function in src/mcp/utils/gitUtils.ts passing user-supplied git reference arguments - branch names, commit hashes, and path patterns - directly to a shell-invoked subprocess without sanitization, enabling shell metacharacter injection. No public exploit has been independently distributed, though the patch commit itself embeds proof-of-concept test cases confirming the injection vector; version 1.9.1 resolves the issue.
Technical ContextAI
Kirachon context-engine is an MCP (Model Context Protocol) server that exposes git operations to AI tooling via endpoints such as review-git-diff. The vulnerable code in src/mcp/utils/gitUtils.ts passed attacker-controlled values - git refs (branch names, commit hashes) and path glob patterns - as shell arguments to child_process calls without setting shell: false, enabling CWE-77 (Improper Neutralization of Special Elements Used in a Command). The commit diff confirms the pre-patch code omitted the shell: false flag and lacked any allowlist validation, meaning shell metacharacters (&, ;, |, backticks) embedded in arguments were interpreted by the OS shell. The fix adds validateSafeGitRef (allowlist regex /^[A-Za-z0-9][A-Za-z0-9._/@-]*$/), validateContextLines (integer bounds check), and validateGitPathPatterns (path traversal and absolute-path checks), and explicitly sets shell: false on subprocess execution. CPE cpe:2.3:a:kirachon:context-engine:*:*:*:*:*:*:*:* scopes the affected product.
RemediationAI
Upgrade to Kirachon context-engine version 1.9.1, which is confirmed available at https://github.com/Kirachon/context-engine/releases/tag/v1.9.1 and corresponds to commit e0729dcfd3a2b1682a7bff86e7174852c03419ba. The patch applies strict allowlist validation on all git ref inputs and disables shell interpolation by setting shell: false on subprocess calls, eliminating the injection surface. If immediate upgrade is not feasible, restrict network access to the MCP server to explicitly trusted clients only - note this is a network-layer workaround and does not remediate the underlying flaw; a compromised or manipulated trusted client could still trigger the injection. No other feature-level workaround is available without code modification.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today