CVE-2026-19266

MediumCVSS 5.5

Published: 08/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 08/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.52%

72th percentile - higher than 72% of all known CVEs

Summary

In the Kirachon context-engine project up to version 1.9.0, a command injection vulnerability was found in the execGitCommand function in src/mcp/utils/gitUtils.ts of the review-git-diff Endpoint component. Manipulating the args argument allows command execution. Version 1.9.1 contains a fix.

Risk Assessment

Command injection could allow an attacker to execute arbitrary commands in the application context, potentially leading to system integrity compromise or data leakage.

Recommendation

Update the component to version 1.9.1 as soon as possible, which contains the fix.

Original NVD description (English source)

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1 mitigates this issue. This patch is called e0729dcfd3a2b1682a7bff86e7174852c03419ba. It is advisable to upgrade the affected component.