PT-2026-25573 · Hypermodel · Mcp-Server-Auto-Commit

Yinci Chen · Published 2026-03-15 · Updated 2026-03-16 · CVE-2026-4198

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions hypermodel-labs mcp-server-auto-commit version 1.0.0

Description A command injection issue exists in the getGitChanges function within the index.ts file. This manipulation allows for local execution of commands. The exploit has been publicly disclosed.

Recommendations Apply patch f7d992c830c5f2ec5749852e66c0195e3ed7fe30 to resolve this issue.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-4198

Affected Products

Mcp-Server-Auto-Commit

References · 10

• 🔥❌ https://github.com/user-attachments/files/25687034/mcp-server-auto-commit_security_advisory.pdf · Exploit, Deleted
• https://github.com/hypermodel-labs/mcp-server-auto-commit/pull/8/changes/f7d992c830c5f2ec5749852e66c0195e3ed7fe30 · Patch
• https://github.com/hypermodel-labs/mcp-server-auto-commit/issues/7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-4198 · Security Note
• https://github.com/hypermodel-labs/mcp-server-auto-commit · Patch
• https://vuldb.com/?ctiid.351110 · Note
• https://vuldb.com/?id.351110 · Note
• https://t.me/CVEtracker/47472 · Telegram Post
• https://vuldb.com/?submit.770421 · Note
• https://twitter.com/CVEnew/status/2033361060003020987 · Twitter Post