CVE-2026-106764 in Mcp-Git-Tools
Summary
by MITRE • 10/23/2026
An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in version 1.0.1 of the @rog0x/mcp-git-tools package represents a critical server-side code execution risk stemming from improper input validation within the resolveBaseBranch function. This specific component is designed to determine the base branch for Git operations, likely by parsing user-supplied inputs or repository configurations. The core technical flaw lies in the failure to sanitize or strictly validate these inputs before they are processed by underlying system commands or interpreted as executable logic. By leveraging this weakness, a remote attacker can inject malicious payloads that bypass standard security controls, effectively turning what should be a benign configuration lookup into a vector for arbitrary code execution on the host machine where the tool is running.
From an operational perspective, the impact of this vulnerability extends far beyond simple data leakage or service disruption. Successful exploitation allows an adversary to gain full control over the affected system environment, potentially leading to complete compromise of the underlying infrastructure. This could result in unauthorized access to sensitive source code repositories, theft of cryptographic keys, installation of persistent backdoors, or use of the compromised host as a pivot point for further attacks within the network. The severity is amplified by the fact that Git tools are often integrated into continuous integration and deployment pipelines, meaning an attacker might achieve execution with elevated privileges associated with build agents or CI/CD service accounts.
This vulnerability aligns closely with CWE-94, which describes Improper Control of Generation of Code (Code Injection), as well as CWE-78, the OS Command Injection category if the flaw involves passing unsanitized input to shell commands. In terms of adversary tactics, this exploitation path corresponds to ATT&CK technique T1059, specifically command and script interpretation, allowing attackers to execute arbitrary system-level instructions without direct interactive access. The lack of strict type checking or allow-listing for branch names is a common pattern in poorly secured utility libraries that assume input integrity from trusted sources, which fails when facing malicious actors capable of manipulating API calls or configuration files.
Mitigation strategies must prioritize immediate remediation through version updates and rigorous input validation practices. Users should upgrade to the latest patched version of @rog0x/mcp-git-tools as soon as it becomes available, ensuring that the vendor has addressed the sanitization logic within the resolveBaseBranch function. In environments where an update is not immediately feasible, defensive measures such as implementing strict allow-lists for branch name characters and disabling unnecessary Git tool integrations can reduce the attack surface. Additionally, adopting principle of least privilege for CI/CD runners and isolating build environments from production systems will limit the blast radius should a similar vulnerability be exploited in other components. Regular security audits focusing on input handling in external-facing or user-controlled functions are essential to prevent recurrence of such code injection flaws.