Live › vulnerability › CVE-2026-106764
Go to dashboardThe @rog0x/mcp-git-tools 1.0.1 package, an MCP server for git operations, contains a flaw in its resolveBaseBranch function. Per the NVD entry, a remote attacker can use it to execute arbitrary code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run the @rog0x/mcp-git-tools MCP server at version 1.0.1, especially where it accepts input from remote clients or from untrusted repository data. The sources do not say which input reaches resolveBaseBranch, so teams without this package can skip it.
No product ranges from the sources yet.
npm ls @rog0x/mcp-git-tools to see whether the package is installed and at which version@rog0x/mcp-git-tools in package.json and lockfiles of MCP server setups@rog0x/mcp-git-tools or move off version 1.0.1 if a fixed release exists; unknown which version fixes itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.
This page as .md · .json · in your agent: get_signal("CVE-2026-106764")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.