| タイトル | 0xshariq github-mcp-server e3be2cc110ec0bb055a699a9b74cf20fe0422e3c Command Injection |
|---|
| 説明 | An OS command injection vulnerability (CWE-78) has been identified in the git_remove MCP tool of 0xshariq github-mcp-server at commit e3be2cc110ec0bb055a699a9b74cf20fe0422e3c. The tool embeds the attacker-controlled file argument in a shell command and passes the resulting string to child_process.exec without safely separating command arguments or neutralizing shell metacharacters. An attacker with access to the MCP interface can escape the quoted filename and execute arbitrary operating-system commands with the privileges of the server process, potentially resulting in unauthorized data access, system modification, or service disruption. A working exploit has been demonstrated using the id command and is publicly available. This product does not use versioning, so affected and unaffected release information is unavailable, and no fixed version is known at the time of reporting. |
|---|
| ソース | ⚠️ https://github.com/0xshariq/github-mcp-server/issues/2 |
|---|
| ユーザー | Xh1Xxhg (UID 90906) |
|---|
| 送信 | 2026年08月31日 06:20 (1 月 ago) |
|---|
| モデレーション | 2026年09月29日 19:48 (30 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 411537 [0xshariq github-mcp-server 迄 52e764a7d66eac1726fce02ca7bb5a638571801a Git Remove MCP Tool src/github.ts child_process.exec file 特権昇格] |
|---|
| ポイント | 20 |
|---|