CVE-2026-102906 in github-mcp-server
Summary
by MITRE • 09/30/2026
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child_process.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The identified vulnerability resides within the Git Remove MCP Tool component of the 0xshariq github-mcp-server application, specifically affecting versions up to commit hash 52e764a7d66eac1726fce02ca7bb5a638571801a. This security flaw is rooted in improper neutralization of special elements used in an operating system command, commonly referred to as OS Command Injection. The vulnerability manifests within the src/github.ts file through the invocation of the child_process.exec function. When processing user-supplied input for the File argument, the application fails to adequately sanitize or validate the data before passing it to the underlying shell interpreter. This lack of rigorous input validation allows an attacker to inject arbitrary operating system commands that are executed with the privileges of the running process, leading to a complete compromise of the host environment.
From a technical perspective, this flaw aligns directly with CWE-78, which defines improper neutralization of special elements used in an OS command. The use of child_process.exec is particularly risky because it spawns a shell to execute commands, thereby exposing the application to injection attacks if any part of the command string is derived from untrusted sources without proper escaping or whitelisting. In this specific implementation, the argument File appears to be concatenated directly into the command string passed to exec. An attacker can manipulate this input by appending additional commands using shell metacharacters such as semicolons, ampersands, or pipes. This allows for the execution of arbitrary system-level operations, including reading sensitive configuration files, exfiltrating data, installing malware, or pivoting to other systems within the network infrastructure.
The operational impact of this vulnerability is severe due to its remote exploitability and the availability of public proof-of-concept exploits. Since the attack can be executed remotely, an adversary does not need prior access to the system but only needs a network connection to the service exposing this functionality. The existence of publicly available exploits significantly lowers the barrier for entry, enabling less skilled threat actors to leverage these attacks against vulnerable instances. Given that the product utilizes a rolling release model, determining the exact version status is challenging as traditional version numbering is absent. This lack of clear versioning complicates patch management and vulnerability assessment efforts for administrators who must rely on commit hashes or feature availability to determine if their deployment is affected.
Furthermore, the response from the project maintainers has been insufficient, with no acknowledgment or fix provided despite early notification via an issue report. This delay in remediation increases the window of exposure for all users running unpatched versions. To mitigate this risk, immediate action is required by either upgrading to a patched version once released or implementing temporary workarounds if available. Recommended mitigations include replacing child_process.exec with safer alternatives such as child_process.spawn, which does not invoke a shell and thus prevents command injection unless explicitly configured to do so. Additionally, strict input validation should be implemented using allowlists for expected file paths and characters, ensuring that only predefined safe inputs are processed. Organizations relying on this tool should monitor the project repository closely for updates or consider migrating to alternative solutions with more robust security practices and active maintenance cycles until a fix is officially published.