What’s Vulnerable › Vulnerabilities

CVE-2026-4496: sigmade Git-MCP-Server gitUtils.ts child_process.exec os command injection

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-20 · updated 2026-06-17
• Weakness: CWE-77

Description

A vulnerability was found in sigmade Git-MCP-Server up to 785aa159f262a02d5791a5d8a8e13c507ac42880. Affected by this vulnerability is the function child_process.exec of the file src/gitUtils.ts of the component show_merge_diff/quick_merge_summary/show_file_diff. The manipulation results in os command injection. The attack must be initiated from a local position. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. It is advisable to implement a patch to correct this issue. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• sigmade Git-MCP-Server: 785aa159f262a02d5791a5d8a8e13c507ac42880

References

• https://github.com/sigmade/Git-MCP-Server/
• https://github.com/sigmade/Git-MCP-Server/issues/1
• https://github.com/sigmade/Git-MCP-Server/pull/2
• https://github.com/user-attachments/files/24855745/Git-MCP-Server.bug.pdf
• https://vuldb.com/?ctiid.352045
• https://vuldb.com/?id.352045
• https://vuldb.com/?submit.773796

Get alerted when CVE-2026-4496 or the next vulnerability affects your stack