Description
Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka view) in the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGE_BASE_URL.
Recommendation
No fix is available yet. Followings are affected versions:
- = 2.5.27
References
Could your website be exposed too?
SmartScanner can check your website for automagik-genie has a command injection vulnerability and gives you actionable findings to investigate.
Start a free scanRelated Issues
- degit has a Command Injection issue - CVE-2026-11572
- electerm has Command Injection in File System Operations (rmrf, mv, cp) - CVE-2026-49255
- electerm has Command Injection via runLinux funtion - CVE-2026-41501
- Velocity.js has a Prototype Pollution vulnerability through #set path assignment - CVE-2026-44966
You might also like:
See something that needs correcting? Let us knowUpdated May 18, 2026