PT-2026-36535 · Eyal Gor · P 69 Branch Monkey Mcp

Largew · Published 2026-05-01 · Updated 2026-05-01 · CVE-2026-7590

Mitre

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A vulnerability was identified in eyal-gor p 69 branch monkey mcp up to 69bc71874ce40050ef45fde5a435855f18af3373. The affected element is an unknown function of the file branch monkey mcp/bridge and local actions/routes/advanced.py of the component Preview Endpoint. Such manipulation of the argument dev script leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-7590

Affected Products

P 69 Branch Monkey Mcp

References · 6

• 🔥 https://github.com/eyal-gor/p_69_branch_monkey_mcp/issues/8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7590 · Security Note
• https://vuldb.com/vuln/360543/cti · Note
• https://github.com/eyal-gor/p_69_branch_monkey_mcp · Note
• https://vuldb.com/vuln/360543 · Note
• https://vuldb.com/submit/804413 · Note