CVE-2026-19266

MEDIUM

Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection

Title source: cna
STIX 2.1

Description

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1 mitigates this issue. This patch is called e0729dcfd3a2b1682a7bff86e7174852c03419ba. It is advisable to upgrade the affected component.

References (9)

Core 9
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-387011 | Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection
https://vuldb.com/vuln/387011
Signature, Permissions Required signature permissions-required
VDB-387011 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/387011/cti
Third Party Advisory third-party-advisory
CVE-2026-19266 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-19266
Third Party Advisory third-party-advisory
Submit #865221 | Kirachon context-engine unknown Command Injection
https://vuldb.com/submit/865221

Scores

CVSS v3 5.5
EPSS 0.0152
EPSS Percentile 72.1%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Details

CWE
CWE-74 CWE-77
Status published
Products (11)
Kirachon/context-engine 1.0
Kirachon/context-engine 1.1
Kirachon/context-engine 1.2
Kirachon/context-engine 1.3
Kirachon/context-engine 1.4
Kirachon/context-engine 1.5
Kirachon/context-engine 1.6
Kirachon/context-engine 1.7
Kirachon/context-engine 1.8
Kirachon/context-engine 1.9.0
... and 1 more
Published Aug 08, 2026
Tracked Since Aug 08, 2026