PT-2025-29513 · Unknown · Github-Kanban-Mcp-Server

Lirantal · Published 2025-07-14 · Updated 2025-07-17 · CVE-2025-53818

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: GitHub Kanban MCP Server versions 0.3.0 through 0.4.0

Description: GitHub Kanban MCP Server is a Model Context Protocol (MCP) server designed for managing GitHub issues in Kanban board format and streamlining LLM task management. The server’s add comment tool utilizes the Node.js exec function to execute the GitHub (gh) command, creating a command injection issue when combined with untrusted user input.

Recommendations: GitHub Kanban MCP Server version 0.3.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. GitHub Kanban MCP Server version 0.4.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-53818

GHSA-6JX8-RCJX-VMWF

Affected Products

Github-Kanban-Mcp-Server

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53818.json · Exploit
• 🔥 https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/security/advisories/GHSA-6jx8-rcjx-vmwf · Exploit
• https://osv.dev/vulnerability/GHSA-6jx8-rcjx-vmwf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53818 · Security Note
• https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/blob/v0.4.0/src/handlers/comment-handlers.ts#L8-L23 · Note
• https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/blob/main/src/handlers/tool-handlers.ts#L79 · Note
• https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/blob/main/src/handlers/comment-handlers.ts#L8 · Note
• https://github.com/Sunwood-ai-labs/github-kanban-mcp-server · Note
• https://twitter.com/SecAideInfo/status/1945789962365841595 · Twitter Post
• https://twitter.com/CVEnew/status/1944860703845736919 · Twitter Post
• https://twitter.com/gothburz/status/1944975212841197570 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1944890342433546415 · Twitter Post
• https://t.me/cvetracker/27820 · Telegram Post