CVE-2026-19282 Details
Description
A weakness has been identified in andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolearn/GitHooksManager.ts of the component llm_memory_mcp. Executing a manipulation of the argument hash can lead to command injection. The attack is restricted to local execution. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
A command injection vulnerability has been identified in the andreahaku llm_memory_mcp component, specifically in the auto.capture function of the GitHooksManager.ts file. This vulnerability affects all versions up to the latest commit f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. The issue arises from the auto.capture operation, which accepts a caller-controlled commit hash and passes it into Git show commands executed via execSync. The lack of proper validation or escaping of the commit hash allows for the injection of arbitrary OS commands, with exploitation possible through a crafted hash argument.
It is recommended to validate the commit hash against a strict Git revision pattern, avoid concatenating strings to create shell commands, and use a subprocess API that allows passing command arguments separately, rather than as a single concatenated string.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 8, 2026CISA-ADP
Assessed Aug 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/andreahaku/llm_memory_mcp/ | [email protected] | Source CodeVendor |
| https://github.com/andreahaku/llm_memory_mcp/issues/21 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-19282 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/865226 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/387023 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/387023/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| andreahaku llm_memory_mcp | <f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 12, 2026 | CVE Modified | CISA-ADP |
| Aug 8, 2026 | New CVE Received | [email protected] |