CVE-2026-19266

medium

Description

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1 mitigates this issue. This patch is called e0729dcfd3a2b1682a7bff86e7174852c03419ba. It is advisable to upgrade the affected component.

References

https://vuldb.com/vuln/387011/cti

https://vuldb.com/vuln/387011

https://vuldb.com/submit/865221

https://vuldb.com/cve/CVE-2026-19266

https://github.com/Kirachon/context-engine/releases/tag/v1.9.1

https://github.com/Kirachon/context-engine/issues/16#issuecomment-4321217057

https://github.com/Kirachon/context-engine/issues/16

https://github.com/Kirachon/context-engine/commit/e0729dcfd3a2b1682a7bff86e7174852c03419ba

https://github.com/Kirachon/context-engine/

Details

Source: Mitre, NVD

Published: 2026-08-08

Updated: 2026-08-08

Risk Information

CVSS v2

Base Score: 5.2

Vector: CVSS2#AV:A/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 5.5

Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Severity: Medium

CVSS v4

Base Score: 5.1

Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.01516