Tracking: CVE-2026-102906
Severity: Medium (CVSS 3.1: 6.3)
Who is affected
The 0xshariq/github-mcp-server project through commit 52e764a7d66eac1726fce02ca7bb5a638571801a. This identifier concerns that repository, not every GitHub-related MCP server.
How the attack works
The GitRemove tool uses a caller-supplied file argument in src/github.ts. Passing the value to child_process.exec allows shell metacharacters to change the command that runs. An attacker must be able to influence the input reaching this tool.
Execution inherits the MCP server account's access. Repository files, Git credentials, and other accessible local data may be exposed or modified.
What to do
- Disable the affected tool or restrict its inputs to reviewed, expected repository paths until a fix is confirmed.
- Inventory the exact repository revision in use. A similarly named package or official integration is not sufficient to establish exposure.
- Review GitRemove calls and process logs for unexpected commands. Track the project and CVE references for a patched revision.
Scope and limits
The record describes a rolling source revision and links a public proof of concept. It does not establish a fixed numbered release or confirmed attacks in the wild.