PT-2026-25573 · Hypermodel · Mcp-Server-Auto-Commit

Yinci Chen · Publicado 2026-03-15 · Atualizado 2026-03-16 · CVE-2026-4198

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions hypermodel-labs mcp-server-auto-commit version 1.0.0

Description A command injection issue exists in the getGitChanges function within the index.ts file. This manipulation allows for local execution of commands. The exploit has been publicly disclosed.

Recommendations Apply patch f7d992c830c5f2ec5749852e66c0195e3ed7fe30 to resolve this issue.

Exploit

Correção

Special Elements Injection

Command Injection

Enumeração de Fraquezas

CWE-74

CWE-77

Identificadores relacionados

CVE-2026-4198

Produtos afetados

Mcp-Server-Auto-Commit

Referências · 10

• 🔥❌ https://github.com/user-attachments/files/25687034/mcp-server-auto-commit_security_advisory.pdf · Exploit, Deleted
• https://github.com/hypermodel-labs/mcp-server-auto-commit/pull/8/changes/f7d992c830c5f2ec5749852e66c0195e3ed7fe30 · Correção
• https://github.com/hypermodel-labs/mcp-server-auto-commit/issues/7 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-4198 · Nota de Segurança
• https://vuldb.com/?ctiid.351110 · Nota
• https://vuldb.com/?id.351110 · Nota
• https://t.me/CVEtracker/47472 · Publicação no Telegram
• https://vuldb.com/?submit.770421 · Nota
• https://twitter.com/CVEnew/status/2033361060003020987 · Publicação no Twitter
• https://github.com/hypermodel-labs/mcp-server-auto-commit · Correção