Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

github-mcp-server allows remote command execution

CVE-2026-102906 · published 19 days ago
Summary

The github-mcp-server tool can run operating‑system commands that an attacker supplies through a file name parameter. This means a remote user could cause the server to execute unwanted actions, potentially compromising the system. Update the software to a version that fixes the issue or disable the vulnerable functionality until a patch is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
0xshariq github-mcp-server 52e764a7d66eac1726fce02ca7bb5a638571801a
Original advisory text
0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child_process.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
1% chance of attack within 30 days
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published30 Sep 2026
Updated19 Oct 2026
First seen30 Sep 2026
Sources
CVE-2026-102906 · NVD
CVE-2026-102906 · MITRE
CVE-2026-102906 · OSV
Track software like this
Free during beta