CVE-2026-106764: @rog0x/mcp-git-tools, a Model Context Protocol (MCP) server, executes arbitrary code via its resolveBaseBranch function
The GitHub-reviewed advisory GHSA-jwc4-922r-f2rw says an issue in @rog0x/mcp-git-tools 1.0.1, a Model Context Protocol (MCP) server package, allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.
The record
- Kind
- Vulnerability
- Source record
- GHSA-jwc4-922r-f2rw: @rog0x/mcp-git-tools: @rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function (GitHub-reviewed advisory via OSV)
- Record published
- 2026-10-23
- Posted here
- 2026-10-30
- World
- Software agents · Enterprise work agents
- Controls concerned
- Containment and isolation C-E5
- Checked
- Checked against its record on 2026-10-30 by a reader who did not draft it; report
verification/reports/SIG-2026-10-30-003-2026-10-30.md.
A signal's controls are the ones its record points at, the exposure; a case's controls are the ones its records show were absent or failed, so the two can differ.
What a signal is. A signal records what a primary record says; it assigns no fault. It is lighter than a case: one dated item from one record, tagged with the world, sector and controls it touches. It becomes a case when it meets the bar for one.
New signals like this, once a week. A short email when a case, signal or rule touches software agents. Free; unsubscribe in one click.
Get the weekly emailNewer: CVE-2026-106763: @justice8096/sagemath-mcp-server, a Model Context Protocol (MCP) server, executes arbitrary code via its escapeShellString and sanitizeCode functions
Older: CVE-2026-114612: LiteLLM proxy