CVE-2026-7628

MediumCVSS 6.3/10Last modified Oct 26, 2026

Description

A vulnerability was detected in crazyrabbitLTC mcp-code-review-server up to 0.1.0. This issue affects the function executeRepomix of the file src/repomix.ts of the component RepoMix Command Handler. Performing a manipulation results in command injection. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
crazyrabbitLTC	mcp-code-review-server	0.1.0

References

Timeline

Published: May 2, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-762806.3In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.7 CVE-2026-76281As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-762828.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-762837.6As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-762849.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-762859.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-762865.3In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom CVE-2026-762875.4In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_manag CVE-2026-762887.5In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the CVE-2026-762896.5In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could CVE-2026-76296.3A flaw has been found in kleneway awesome-cursor-mpc-server up to 2.0.1. Impacted is the function runCodeReviewTool of the file src/tools/co CVE-2026-762907.5In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor