Llm Memory Mcp
Monthly
Command injection in andreahaku llm_memory_mcp allows local attackers with limited privileges to execute arbitrary OS commands by manipulating the `hash` argument passed to the `auto.capture` function in `GitHooksManager.ts`. All commits up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0 are affected, and a proof-of-concept is indicated as available via the CVSS 4.0 E:P enrichment. No patch has been released, and the project maintainer has not responded to the coordinated disclosure reported via GitHub issue.
Command injection in andreahaku llm_memory_mcp allows local attackers with limited privileges to execute arbitrary OS commands by manipulating the `hash` argument passed to the `auto.capture` function in `GitHooksManager.ts`. All commits up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0 are affected, and a proof-of-concept is indicated as available via the CVSS 4.0 E:P enrichment. No patch has been released, and the project maintainer has not responded to the coordinated disclosure reported via GitHub issue.