CVE-2026-116369 in github-kanban-mcp-server
Summary
by MITRE • 10/26/2026
A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue. The name of the patch is 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae. It is suggested to upgrade the affected component.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
A critical security vulnerability has been identified in Sunwood-ai-labs github-kanban-mcp-server, specifically affecting versions up through 0.4.0. This flaw resides within the handleListIssues function located in the source file src/handlers/issue-handlers.ts. The core issue is a failure to properly sanitize user-supplied input before it is passed to underlying system commands. Specifically, arguments related to state and labels are manipulated without adequate validation or escaping mechanisms, creating an opening for attackers to inject arbitrary operating system commands into the execution context of the application.
The technical nature of this flaw constitutes an OS command injection vulnerability, which aligns with CWE-78 in the Common Weakness Enumeration taxonomy. This type of weakness occurs when a software application constructs part of an OS command using externally-influenced input from an upstream component but fails to neutralize special elements that could alter the intended command syntax. In this specific instance, the lack of rigorous input validation allows malicious actors to terminate the intended argument and append additional commands. Because the vulnerability is present in a handler function likely exposed through an API or interface managed by the MCP server, the attack vector is remote. This means an attacker does not need physical access or local authentication privileges on the host machine; they can exploit this flaw over a network connection if the service is accessible.
The operational impact of such a vulnerability is severe and potentially catastrophic for the affected system. Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands with the same privileges as the user account running the github-kanban-mcp-server process. This could lead to complete compromise of the underlying host, including unauthorized access to sensitive data, modification or deletion of files, installation of malware, and use of the compromised server as a pivot point for further attacks against other systems within the network. The ability to execute commands remotely significantly lowers the barrier to entry for attackers, making this vulnerability highly exploitable in automated attack scenarios.
To mitigate this risk, immediate action is required by upgrading the github-kanban-mcp-server component to version 0.4.1 or later. This update includes a specific patch identified by commit hash 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae, which addresses the input validation deficiencies in the handleListIssues function. The developers have implemented fixes that ensure proper sanitization of state and label arguments before they are processed by system commands. Organizations relying on this tool should prioritize applying this update to their production environments to close the security gap. Additionally, it is advisable to review logging mechanisms to detect any potential exploitation attempts post-upgrade and to adhere to secure coding practices such as using parameterized interfaces or whitelisting allowed inputs rather than attempting to blacklist dangerous characters in future development cycles.