IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-05-11 18:16

MODIFIED

2026-05-11 18:16

EPSS (Prob. Exploit)

1.43%

Top 27.2%

DATA SOURCES:

NVD 🔗 2026-05-11 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-05

> DESCRIPTION

Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka view) in the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGE_BASE_URL.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-64vr-4gr2-m642 HIGH

automagik-genie has a command injection vulnerability

AFFECTED PACKAGES:

NPM / automagik-genie

= 2.5.27

> HISTORIQUE DES MODIFICATIONS

Première apparition

11/05/2026 18:16

Source: NVD

Total des modifications: 0 Dernière mise à jour: 5 months ago

> REFERENCES