CVE-2026-116369

GitHub Kanban MCP list_issues arguments reach a shell command

Sunwood-ai-labs · github-kanban-mcp-server

First documented disclosure · Review checkpoint

Summary

Untrusted issue-listing arguments can become host commands in the GitHub Kanban MCP server.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Real-world malicious exploitation is not established by the reviewed primary sources; a vulnerability report or public demonstration is not evidence of a victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

handleListIssues interpolates state and labels into child_process.exec shell strings.

Conditions required

An attacker must control arguments passed to list_issues through an MCP client or influence the connected model to pass them. The CNA vector includes user interaction.

Potential impact

Commands execute with the MCP server process privileges, potentially exposing or changing host data.

Affected versions and configurations

Versions through 0.4.0; CNA enumerates 0.1, 0.2, 0.3 and 0.4.0.

Fix and mitigation status

0.4.1; CNA identifies commit 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae.

Practical next steps

Upgrade to 0.4.1 or later. The public fix removes shell interpolation in favor of execFile argument arrays and validates arguments.

Operating lesson

MCP tool implementations must validate arguments independently of model instructions.

Evidence and limits

Public issue #26 disclosed the list_issues weakness on March 8, after a private February 2 report. PR #27 merged June 22; CNA assignment followed October 26. The stale submission says no patch, superseded by the CNA and merged fix. Issue and PR cite different private GHSA IDs, both inaccessible; do not claim those IDs are confirmed aliases.

Sources