CVE-2026-19266CWE-74CWE-77command-injection

CVE-2026-19266

Medium · published August 8, 2026

CVSS v3.1
5.5
EPSS
4%
Percentile
90.3
In the wild
Unconfirmed
What it is

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1 mitigates this issue. This patch is called e0729dcfd3a2b1682a7bff86e7174852c03419ba. It is advisable to upgrade the affected component.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.03912 · 90.3th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-08-08T12:16Z
References (9)
https://github.com/Kirachon/context-engine/ · [email protected]https://github.com/Kirachon/context-engine/commit/e0729dcfd3a2b1682a7bff86e7174852c03419ba · [email protected]https://github.com/Kirachon/context-engine/issues/16 · [email protected]https://github.com/Kirachon/context-engine/issues/16#issuecomment-4321217057 · [email protected]https://github.com/Kirachon/context-engine/releases/tag/v1.9.1 · [email protected]https://vuldb.com/cve/CVE-2026-19266 · [email protected]https://vuldb.com/submit/865221 · [email protected]https://vuldb.com/vuln/387011 · [email protected]https://vuldb.com/vuln/387011/cti · [email protected]
EPSS history
Timeline
  • 08 AUG 07:15Z
    Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection
    cvelistv5