Github Mcp Server
Monthly
OS command injection in the Git Remove MCP Tool of 0xshariq github-mcp-server (all revisions up to commit 52e764a7d66eac1726fce02ca7bb5a638571801a) lets an attacker who can influence the tool's 'File' argument inject shell metacharacters that are executed by child_process.exec in src/github.ts. Publicly available exploit code exists (reported via a GitHub issue on the project's own repository), but there is no evidence of confirmed active exploitation in CISA KEV, and the vendor has not responded to the report. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as high, although the practical exposure depends heavily on how the MCP server is deployed - a network-accessible MCP transport makes the AV:N path realistic, whereas a local stdio deployment limits reach to whatever can feed input into the connected LLM client.
OS command injection in the Git Remove MCP Tool of 0xshariq github-mcp-server (all revisions up to commit 52e764a7d66eac1726fce02ca7bb5a638571801a) lets an attacker who can influence the tool's 'File' argument inject shell metacharacters that are executed by child_process.exec in src/github.ts. Publicly available exploit code exists (reported via a GitHub issue on the project's own repository), but there is no evidence of confirmed active exploitation in CISA KEV, and the vendor has not responded to the report. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as high, although the practical exposure depends heavily on how the MCP server is deployed - a network-accessible MCP transport makes the AV:N path realistic, whereas a local stdio deployment limits reach to whatever can feed input into the connected LLM client.