automagik-genie has a command injection vulnerability

Description

Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka view) in the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGE_BASE_URL.

Recommendation

No fix is available yet. Followings are affected versions:

• = 2.5.27

References

• GHSA-64vr-4gr2-m642
• CVE-2026-30635
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• degit has a Command Injection issue - CVE-2026-11572
• electerm has Command Injection in File System Operations (rmrf, mv, cp) - CVE-2026-49255
• electerm has Command Injection via runLinux funtion - CVE-2026-41501
• Velocity.js has a Prototype Pollution vulnerability through #set path assignment - CVE-2026-44966

You might also like:

How do hackers hack websites?

Exploiting Server Version Disclosure

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

automagik-genie