{"id":"CVE-2026-106764","kind":"vulnerability","aliases":["CVE-2026-106764"],"related":[],"title":"mcp-git-tools npm package: resolveBaseBranch flaw allows remote code execution","description":"An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.","summary":"The @rog0x/mcp-git-tools 1.0.1 package, an MCP server for git operations, contains a flaw in its resolveBaseBranch function. Per the NVD entry, a remote attacker can use it to execute arbitrary code.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","git","mcp","node","npm"],"not_affected_if":["package-not-installed"],"how_to_check":"- `npm ls @rog0x/mcp-git-tools` to see whether the package is installed and at which version\n- Look for `@rog0x/mcp-git-tools` in `package.json` and lockfiles of MCP server setups\n- unknown whether the vulnerable code path is reached in typical use","fix":"- Remove `@rog0x/mcp-git-tools` or move off version `1.0.1` if a fixed release exists; unknown which version fixes it\n- Rotate any credentials available to the MCP server process if it ran exposed","status":"open","published_at":"2026-10-23T15:17:23+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:14:51+00:00","updated_at":"2026-10-25T03:14:51+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-25T03:14:51Z","model":"claude-haiku-5-5","output":{"fix":"- Remove `@rog0x/mcp-git-tools` or move off version `1.0.1` if a fixed release exists; unknown which version fixes it\n- Rotate any credentials available to the MCP server process if it ran exposed","reach":"unknown","title":"mcp-git-tools npm package: resolveBaseBranch flaw allows remote code execution","impact":"high","summary":"The @rog0x/mcp-git-tools 1.0.1 package, an MCP server for git operations, contains a flaw in its resolveBaseBranch function. Per the NVD entry, a remote attacker can use it to execute arbitrary code.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","npm","git","node"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the host running the MCP server","analyst_note":"Check the NVD entry and the package repository for the vulnerable input path in resolveBaseBranch and the fixed version.","how_to_check":"- `npm ls @rog0x/mcp-git-tools` to see whether the package is installed and at which version\n- Look for `@rog0x/mcp-git-tools` in `package.json` and lockfiles of MCP server setups\n- unknown whether the vulnerable code path is reached in typical use","needs_analyst":true,"not_affected_if":["package-not-installed"],"who_is_affected":"Teams that run the @rog0x/mcp-git-tools MCP server at version 1.0.1, especially where it accepts input from remote clients or from untrusted repository data. The sources do not say which input reaches resolveBaseBranch, so teams without this package can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000637,"input_tokens":3288,"output_tokens":617,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-106764':15A,18A '-2026':14A,17A '1.0.1':28B,61C 'ai':20B 'ai-tool':19B 'allow':9A,62C 'arbitrari':55B,68C 'attack':49B,65C 'code':11A,56B,69C 'contain':36B 'cve':13A,16A 'entri':46B 'execut':12A,54B,67C 'flaw':8A,38B 'function':42B,73C 'git':3A,22B,34B 'issu':58C 'mcp':2A,23B,31B 'mcp-git-tool':1A 'node':24B 'npm':5A,25B 'nvd':45B 'oper':35B 'packag':6A,29B 'per':43B 'remot':10A,48B,64C 'resolvebasebranch':7A,41B,72C 'rog0x/mcp-git-tools':27B,60C 'server':32B 'tool':4A,21B 'use':51B 'via':70C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the @rog0x/mcp-git-tools MCP server at version 1.0.1, especially where it accepts input from remote clients or from untrusted repository data. The sources do not say which input reaches resolveBaseBranch, so teams without this package can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106764","severity":null,"published_at":"2026-10-23T15:17:23+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}