32 matches found
OPENSUSE-SU-2026:12284-1 github-mcp-server-2.0.3-1.1 on GA media
These are all security issues fixed in the github-mcp-server-2.0.3-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-114437 vulnerabilities
Vulnerabilities for packages: step, redpanda-console, crossplane-cli, caddy, apply-cve-bump, kyverno-policy-reporter-ui-fips, zarf-fips, coder, cortex-fips, kubescape, llm-d-router, terraform-provider-cosign, tkn, fluxcd-kustomize-mutating-webhook, omni, gitea, spire-server, continuity,...
GHSA-J6QF-3M9C-VWJ3 vulnerabilities
Vulnerabilities for packages: step, redpanda-console, crossplane-cli, caddy, apply-cve-bump, kyverno-policy-reporter-ui-fips, zarf-fips, coder, cortex-fips, kubescape, llm-d-router, terraform-provider-cosign, tkn, fluxcd-kustomize-mutating-webhook, omni, gitea, spire-server, continuity,...
GHSA-J6QF-3M9C-VWJ3 vulnerabilities
Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, vexctl, zarf, kubescape, neuvector-sigstore-interface, cosign, crossplane, sftpgo, dapr, step, kyverno, caddy, gitea, tekton-chains, mariadb-operator, step-issuer, slsa-verifier, kyverno-notation-aws, cloudflared, step-ca,...
CVE-2026-114437 vulnerabilities
Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, vexctl, zarf, kubescape, neuvector-sigstore-interface, cosign, crossplane, sftpgo, dapr, step, kyverno, caddy, gitea, tekton-chains, mariadb-operator, step-issuer, slsa-verifier, kyverno-notation-aws, cloudflared, step-ca,...
CVE-2026-102906
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
CVE-2026-102906
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
CVE-2026-102906 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
CVE-2026-102906 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
EUVD-2026-89579
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
CVE-2026-102906 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
CVE-2026-102906
The 0xshariq github-mcp-server is vulnerable to an OS command injection in the Git Remove MCP Tool component. The flaw exists within the child_process.exec function of the src/github.ts file, where manipulation of the File argument allows for remote code execution. The exploit is publicly availab...
PT-2026-103000
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child process.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
CVE-2026-102906: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
SUSE CVE-2026-47427
GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...
CVE-2026-81100
tiger-gh-mcp-server (by Timescale) started its MCP HTTP transport without enabling the DNS-rebinding-protection option provided by the underlying SDK. The file src/httpServer.ts called the shared httpServerFactory helper but never set the host allow-list, so the transport accepted requests regard...
CVE-2026-81100
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...
CVE-2026-81100 Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...
GO-2026-6118 GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler in github.com/github/github-mcp-server
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler in github.com/github/github-mcp-server...