CVE-2026-4198

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability was determined in hypermodel-labs mcp-server-auto-commit 1.0.0. Affected by this vulnerability is the function getGitChanges of the file index.ts. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: f7d992c830c5f2ec5749852e66c0195e3ed7fe30. Applying a patch is the recommended action to fix this issue. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Mar 16, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-419805.5Permission control vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect service confidCVE-2026-419815.3Out-of-bounds write vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-419826.4Race condition vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-419834.3Null pointer dereference vulnerability in the browser module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-419845.2UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity.CVE-2026-419855.1UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity.CVE-2026-419862.4Logic bypass vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-419876.2Permission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availabilityCVE-2026-419882.5uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUIDCVE-2026-419896.7Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.CVE-2026-41995.3A vulnerability was identified in bazinga012 mcp_code_executor up to 0.3.0. Affected by this issue is the function installDependencies of thCVE-2026-419904.0Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.