{"id":"GHSA-jwc4-922r-f2rw","revision":"6d3dbb612a3246e5bc90f27ff9f1ec8e","records":[{"revision":"6d3dbb612a3246e5bc90f27ff9f1ec8e","observedAt":"2026-10-29T21:49:13.915+00:00","statement":{"source":"osv","id":"GHSA-jwc4-922r-f2rw","aliases":["CVE-2026-106764"],"title":"@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function","description":"An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.","state":0,"publishedAt":"2026-10-23T15:31:39+00:00","modifiedAt":"2026-10-29T21:15:03.4556571+00:00","affected":[{"ecosystem":"npm","name":"@rog0x/mcp-git-tools","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.0.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-106764","https://github.com/rog0x/mcp-git-tools/issues/1","https://github.com/rog0x/mcp-git-tools","https://stillosdigitalholdings.com/advisories/CVE-2026-106764.cve.json","https://www.npmjs.com/package/@rog0x/mcp-git-tools"],"sourceUrl":"https://github.com/advisories/GHSA-jwc4-922r-f2rw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jwc4-922r-f2rw","identifiers":["GHSA-jwc4-922r-f2rw","CVE-2026-106764"]},"retained":false,"historicalAffected":[]}],"coverage":[]}