| Title | Sunwood-ai-labs github-kanban-mcp-server (npm: @sunwood-ai-labs/github-kanban-mcp-server) 0a4f9f92a13a201fe31cda310da1c95d63876579 OS Command Injection (CWE-78) |
|---|
| Description | A vulnerability was found in Sunwood-ai-labs github-kanban-mcp-server up to 0a4f9f92a13a201fe31cda310da1c95d63876579. Affected is the function handleListIssues in src/handlers/issue-handlers.ts, part of the list_issues tool. The arguments state and labels are interpolated unsanitized into a shell command executed through child_process.exec. Manipulation with shell metacharacters (e.g. ";") leads to OS command injection and arbitrary command execution with the privileges of the MCP server process. The attack can be initiated by a malicious MCP client or by prompt injection against the connected LLM. No patch is available, and the vendor did not respond to a private report (GitHub Security Advisory, Feb 2, 2026) or to a public issue.
Proof of concept: call the list_issues tool with {"path": ".", "state": "open; touch /tmp/kanban_poc; #"}. The file /tmp/kanban_poc is created on the host.
Suggested fix: use execFile/spawn with an argument array instead of exec, and allow-list state to open/closed/all.
CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) |
|---|
| Source | ⚠️ https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/issues/26 |
|---|
| User | h4ckwither (UID 101893) |
|---|
| Submission | 10/04/2026 11:59 (23 days ago) |
|---|
| Moderation | 10/26/2026 09:05 (22 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426333 [Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0 issue-handlers.ts handleListIssues state/labels os command injection] |
|---|
| Points | 20 |
|---|