CVE-2026-5619

MediumCVSS 5.3/10Last modified Jul 24, 2026

Description

A flaw has been found in Braffolk mcp-summarization-functions up to 0.1.5. This impacts an unknown function of the file src/server/mcp-server.ts of the component summarize_command. Executing a manipulation of the argument command can lead to os command injection. The attack requires local access. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2026
Last modified
Jul 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-561909.8Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.CVE-2026-5619110.0Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.CVE-2026-561925.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-561933.3Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-561948.8Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges over a network.CVE-2026-561955.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-561968.8Relative path traversal in Windows Admin Center allows an authorized attacker to execute code over a network.CVE-2026-561978.8Improper neutralization of special elements used in a command ('command injection') in Windows Admin Center allows an authorized attacker toCVE-2026-561987.8Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.CVE-2026-56206.3A vulnerability has been found in itsourcecode Construction Management System 1.0. Affected is an unknown function of the file /borrowed_equCVE-2026-562079.8Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name CVE-2026-562087.6A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Pro
CVE-2026-5619: Medium severity, CVSS 5.3 | Vulnix