{"id":"EUVD-2026-109095","enisaUuid":"10e7aceb-e9c0-35c7-919b-abc06f08c2b0","description":"An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.","datePublished":"Oct 23, 2026, 12:00:00 AM","dateUpdated":"Oct 29, 2026, 2:41:54 AM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R","references":"https://www.npmjs.com/package/@rog0x/mcp-git-tools\nhttps://github.com/rog0x/mcp-git-tools/issues/1\nhttps://stillosdigitalholdings.com/advisories/CVE-2026-106764.cve.json\n","aliases":"CVE-2026-106764\nGHSA-jwc4-922r-f2rw\n","assigner":"mitre","epss":0.52,"enisaIdProduct":[{"id":"3193397e-03ce-3db9-8aa6-f5ee2ff110a3","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"enisaIdVendor":[{"id":"567f4bd8-b477-3fc8-a2b5-fa870f8ab2a0","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"7d2f70e9-f0a3-3c18-b8d2-bd9c74a9a4bc","vulnerability":{"id":"GHSA-jwc4-922r-f2rw","description":"@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function","datePublished":"Oct 23, 2026, 3:31:39 PM","dateUpdated":"Oct 29, 2026, 8:58:04 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-106764\nhttps://github.com/rog0x/mcp-git-tools/issues/1\nhttps://github.com/rog0x/mcp-git-tools\nhttps://stillosdigitalholdings.com/advisories/CVE-2026-106764.cve.json\nhttps://www.npmjs.com/package/@rog0x/mcp-git-tools\n","enisa_id":"EUVD-2026-109095\n","aliases":"GHSA-jwc4-922r-f2rw\nCVE-2026-106764\n","epss":0.0,"dataProcessed":"Nov 4, 2026, 7:03:17 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9df022ee-7584-34d2-abb7-cb238aba3d63","vulnerability":{"id":"CVE-2026-106764","description":"An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.","datePublished":"Oct 23, 2026, 12:00:00 AM","dateUpdated":"Oct 29, 2026, 2:41:54 AM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R","references":"https://www.npmjs.com/package/@rog0x/mcp-git-tools\nhttps://github.com/rog0x/mcp-git-tools/issues/1\nhttps://stillosdigitalholdings.com/advisories/CVE-2026-106764.cve.json\n","enisa_id":"EUVD-2026-109095\n","assigner":"mitre","epss":0.52,"dataProcessed":"Nov 4, 2026, 7:15:51 AM","vulnerabilityProduct":[{"id":"ee11a09c-8856-3747-af65-1e80a0ba43a3","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"vulnerabilityVendor":[{"id":"8efb5aa5-bec6-3cac-9bf6-c010ddafcc12","vendor":{"name":"n/a"}}]}}],"enisaIdAdvisory":[]}