GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler

Summary A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed completion/complete request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service. Details The CompletionsHandler functio...

Vulnera

Strix The open-source AI pentesting tool. Autonomous AI h...

CVE-2026-65893

creationtimestamp| type| source ---|---|--- 2026-07-28 14:00:06+00:00| seen| https://t.me/GithubRedTeam/95522 2026-07-28 21:00:05+00:00| seen| https://t.me/GithubRedTeam/95588 2026-07-29 00:00:08+00:00| seen| Telegram/Q1yPTM1HokNzfLpkFc6iUNC00bXozy1Qi57vCkUVkSVfE8 2026-07-29 00:00:12+00:00| seen|...

Setup GitHub Enterprise - Detect

Detects Setup GitHub Enterprise - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Setup GitHub Enterprise - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Setup GitHub Enterprise - Detect',...

GitHub Debug Page Detection

Detects GitHub Debug Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects GitHub Debug Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GitHub Debug Page Detection', 'description': 'Detects GitHub Debug...

Github Gemfiles Detection

Find github page filesGemfile / Gemfile.lock !/usr/bin/env python3 -- coding: utf-8 -- """Find github page filesGemfile / Gemfile.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Github Gemfiles Detection',...

OpenEMR < 7.0.1 - Cross-Site Scripting Detection

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.""" from kittysploit import from lib.protocols.http.httpclient import...

GitHub Enterprise - Encrypted SAML Detection

This template checks if Encrypted SAML Security Assertion Markup Language is enabled on a GitHub Enterprise instance. !/usr/bin/env python3 -- coding: utf-8 -- """This template checks if Encrypted SAML Security Assertion Markup Language is enabled on a GitHub Enterprise .""" from kittysploit impo...

Github Enterprise Login Panel - Detect

Github Enterprise login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Github Enterprise login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Github Enterprise Login Panel -...

Github pages config file Detection

Find github pages config file. !/usr/bin/env python3 -- coding: utf-8 -- """Find github pages config file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Github pages config file Detection', 'description': 'Find...

nitely/spirit 0.12.3 - Open Redirect Detection

Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

GHSA-7XGM-5PRM-V5GC vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester...

CVE-2026-47427: NULL Pointer Dereference

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

PT-2026-65504

Name of the Vulnerable Software and Affected Versions GitHub MCP Server versions prior to 1.1.0 Description A nil pointer dereference occurs in the CompletionsHandler function within pkg/github/server.go when processing a completion/complete request. The issue arises because the server accesses t...

Malicious code in @antv/narrative-text-editor (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/x6-vector (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/word-scale-chart (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/gi-assets-xlab (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/gi-theme-antd (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/github-config-cli (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...