CVE-2026-4496 Details
Description
A vulnerability was found in sigmade Git-MCP-Server up to 785aa159f262a02d5791a5d8a8e13c507ac42880. Affected by this vulnerability is the function child_process.exec of the file src/gitUtils.ts of the component show_merge_diff/quick_merge_summary/show_file_diff. The manipulation results in os command injection. The attack must be initiated from a local position. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. It is advisable to implement a patch to correct this issue. The vendor was contacted early about this disclosure but did not respond in any way.
A command injection vulnerability exists in sigmade Git-MCP-Server versions through 785aa159f262a02d5791a5d8a8e13c507ac42880. The issue arises from the unsafe use of the child_process.execSync function in the file src/gitUtils.ts. This vulnerability affects multiple components, including show_merge_diff, quick_merge_summary, and show_file_diff. The vulnerability allows for arbitrary OS command execution, with the exploitation needing to be initiated locally.
A patch has been developed and is available as a pull request on the Git-MCP-Server repository. This patch replaces the use of execSync with execFileSync, which is a safer alternative that prevents command injection by treating command arguments as separate elements.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 20, 2026CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sigmade/Git-MCP-Server/ | [email protected] | ProductSource CodeVendor |
| https://github.com/sigmade/Git-MCP-Server/issues/1 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/sigmade/Git-MCP-Server/pull/2 | [email protected] | Issue TrackingVendor |
| https://github.com/user-attachments/files/24855745/Git-MCP-Server.bug.pdf | [email protected] | ExploitTechnical Description |
| https://vuldb.com/?ctiid.352045 | [email protected] | Content Wall |
| https://vuldb.com/?id.352045 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/?submit.773796 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sigmade Git-MCP-Server | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |