CVE-2026-7628

MEDIUM

crazyrabbitLTC mcp-code-review-server RepoMix repomix.ts executeRepomix command injection

Title source: cna
STIX 2.1

Description

A vulnerability was detected in crazyrabbitLTC mcp-code-review-server up to 0.1.0. This issue affects the function executeRepomix of the file src/repomix.ts of the component RepoMix Command Handler. Performing a manipulation results in command injection. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-360574 | crazyrabbitLTC mcp-code-review-server RepoMix repomix.ts executeRepomix command injection
https://vuldb.com/vuln/360574
Signature, Permissions Required signature permissions-required
VDB-360574 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/360574/cti
Third Party Advisory third-party-advisory
Submit #806469 | crazyrabbitLTC mcp-code-review-server <=0.1.0 Command Injection
https://vuldb.com/submit/806469

Scores

CVSS v3 6.3
EPSS 0.0123
EPSS Percentile 79.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-77
Status published
Products (1)
crazyrabbitLTC/mcp-code-review-server 0.1.0
Published May 02, 2026
Tracked Since May 02, 2026