Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-19282: andreahaku llm_memory_mcp can run unwanted commands via Git hook

CVE-2026-19282 · published 2 months ago

Summary

The llm_memory_mcp component’s GitHooksManager can be tricked into executing system commands when a specially crafted hash is supplied to its auto.capture function. This risk is limited to someone who can run code on the same machine, but it could allow them to run arbitrary commands. Apply any available patches, limit who can invoke the Git hook, and consider disabling or reviewing this feature until it is fixed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
andreahaku	llm_memory_mcp	f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0

Original advisory text

andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injection

A weakness has been identified in andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolearn/GitHooksManager.ts of the component llm_memory_mcp. Executing a manipulation of the argument hash can lead to command injection. The attack is restricted to local execution. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19282... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-19282 Vendor Advisory
https://vuldb.com/vuln/387023 Vendor Advisory
https://github.com/andreahaku/llm_memory_mcp/issues/21 Third Party Advisory
https://vuldb.com/vuln/387023/cti Third Party Advisory
https://github.com/andreahaku/llm_memory_mcp/ URL
https://vuldb.com/cve/CVE-2026-19282 Vendor Advisory
https://vuldb.com/submit/865226 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.9 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-77Command Injection

CWE-74Injection

Timeline

Published8 Aug 2026

Updated4 Nov 2026

First seen8 Aug 2026

Sources

CVE-2026-19282 · NVD

CVE-2026-19282 · MITRE

CVE-2026-19282 · OSV

Track software like this

Free during beta