@rog0x/mcp-git-tools

1 published security advisory credited to Still OS Digital Holdings LLC via MITRE.

CVE-2026-106764 ASSIGNED Command Injection (CWE-78) — Remote Code Execution

@rog0x/mcp-git-tools@1.0.1

A remote attacker can execute arbitrary code by supplying a crafted MCP tool-call argument that is interpolated into a shell command.

Maintain or operate @rog0x/mcp-git-tools? If a fix is shipped, the record is disputed, or you want the full coordinated-disclosure writeup, reach us: here. "Listed" means an independent finding was reported through MITRE and made public — not an accusation of intent. Still OS Digital Holdings LLC · security@stillosdigitalholdings.com.