PT-2026-29087 · Unknown · Raine Consult-Llm-Mcp

Yinci Chen · Publicado 2026-03-30 · Atualizado 2026-03-31 · CVE-2026-5125

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions raine consult-llm-mcp versions through 2.5.3

Description A flaw exists in the child process.execSync function within the src/server.ts file. Manipulation of the git diff.base ref/git diff.files argument can lead to operating system command injection. This issue is only exploitable with local access. The exploit is publicly available.

Recommendations Upgrade to version 2.5.4 to address this issue.

Exploit

Correção

Command Injection

OS Command Injection

Enumeração de Fraquezas

CWE-77

CWE-78

Identificadores relacionados

CVE-2026-5125

Produtos afetados

Raine Consult-Llm-Mcp

Referências · 10

• 🔥❌ https://github.com/user-attachments/files/25821105/consult-llm-mcp_bug.pdf · Exploit, Deleted
• https://github.com/raine/consult-llm-mcp/issues/6 · Nota
• https://github.com/raine/consult-llm-mcp/releases/tag/v2.5.4 · Correção
• https://github.com/raine/consult-llm-mcp/commit/4abf297b34e5e8a9cb364b35f52c5f0ca1d599d3 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-5125 · Nota de Segurança
• https://vuldb.com/vuln/354157/cti · Nota
• https://github.com/raine/consult-llm-mcp · Nota
• https://vuldb.com/submit/780154 · Nota
• https://vuldb.com/vuln/354157 · Nota
• https://twitter.com/CVEnew/status/2039004517954457656 · Publicação no Twitter