28 matches found
OPENSUSE-SU-2026:12284-1 github-mcp-server-2.0.3-1.1 on GA media
These are all security issues fixed in the github-mcp-server-2.0.3-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-114437 vulnerabilities
Vulnerabilities for packages: dapr, fleet-server, gitea-fips, chainctl-fips, kyverno-policy-reporter-ui, kyverno, redpanda-operator, llm-d-router, cloudflared-fips, spire-server-fips, chainloop-control-plane, tekton-chains, crossplane, step-fips, coder, cosmo-router-fips, step,...
GHSA-J6QF-3M9C-VWJ3 vulnerabilities
Vulnerabilities for packages: dapr, fleet-server, gitea-fips, chainctl-fips, kyverno-policy-reporter-ui, kyverno, redpanda-operator, llm-d-router, cloudflared-fips, spire-server-fips, chainloop-control-plane, tekton-chains, crossplane, step-fips, coder, cosmo-router-fips, step,...
GHSA-J6QF-3M9C-VWJ3 vulnerabilities
Vulnerabilities for packages: sftpgo, github-mcp-server, gitsign, zot, rclone, zarf, neuvector-sigstore-interface, cosign, ratify, cortex, tkn, kubescape, tekton-chains, gitness, kyverno-notation-aws, fluxcd-kustomize-mutating-webhook, crossplane, step-ca, cloudflared, step, vexctl,...
CVE-2026-114437 vulnerabilities
Vulnerabilities for packages: sftpgo, github-mcp-server, gitsign, zot, rclone, zarf, neuvector-sigstore-interface, cosign, ratify, cortex, tkn, kubescape, tekton-chains, gitness, kyverno-notation-aws, fluxcd-kustomize-mutating-webhook, crossplane, step-ca, cloudflared, step, vexctl,...
CVE-2026-102906
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
EUVD-2026-89579
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
CVE-2026-102906
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
CVE-2026-102906 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
CVE-2026-102906
The 0xshariq github-mcp-server is vulnerable to an OS command injection in the Git Remove MCP Tool component. The flaw exists within the child_process.exec function of the src/github.ts file, where manipulation of the File argument allows for remote code execution. The exploit is publicly availab...
CVE-2026-102906 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
CVE-2026-102906 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
PT-2026-103000
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child process.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
CVE-2026-102906: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
SUSE CVE-2026-47427
GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...
GO-2026-6118 GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler in github.com/github/github-mcp-server
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler in github.com/github/github-mcp-server...
PT-2026-80363
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler in github.com/github/github-mcp-server...
GO-2026-4569 vulnerabilities
Vulnerabilities for packages: ferretdb, github-mcp-server, opencost, gptscript, jaeger, osv-scanner...
CVE-2026-47427
GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...
CVE-2026-47427: NULL Pointer Dereference
GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...