CVE-2026-116369 Details
Description
A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue. The name of the patch is 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae. It is suggested to upgrade the affected component.
A command injection vulnerability has been identified in Sunwood AI Labs GitHub Kanban MCP Server versions prior to 0.4.0. The issue arises in the handleListIssues function within the issue-handlers.ts file, where improper handling of the state and labels arguments allows for OS command injection. This vulnerability can be exploited remotely.
Users are advised to upgrade to version 0.4.1, which addresses the command injection vulnerability by removing the execution of GitHub CLI commands that could be exploited. The patched version is available on the GitHub repository's release page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/ | [email protected] | ProductVendor |
| https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/commit/253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae | [email protected] | Source CodeVendor |
| https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/issues/26 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/pull/27 | [email protected] | Issue TrackingVendor |
| https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/releases/tag/v0.4.1 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-116369 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1013075 | [email protected] | Permission Required |
| https://vuldb.com/vuln/426333 | [email protected] | Permission Required |
| https://vuldb.com/vuln/426333/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sunwood-ai-labs github-kanban-mcp-server | <= 0.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 31, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |