Executive brief
The GitHub Kanban MCP Server is a tool that integrates GitHub issue and pull request management with AI assistants and code editors. It contains a command injection vulnerability in the add_comment tool that could allow remote attackers to execute arbitrary commands on the server when an LLM is tricked via prompt injection to call the tool with specially crafted input. This could lead to complete system compromise.
Technical details
The vulnerability is an OS command injection (CWE-78) in the handleAddComment() function, which uses Node.js child_process.exec() to run the GitHub CLI command. The vulnerable code concatenates unsanitized user input (args.issue_number and args.repo) directly into the shell command string. An attacker can inject shell metacharacters (e.g., `;`, `|`, `&&`) through prompt injection to the connected LLM, causing arbitrary commands to execute on the host. The attack requires the MCP Server to be network-reachable and connected to an LLM that can be manipulated via prompt injection. The recommended fix is to replace exec() with execFile() and pass arguments as an array instead of a concatenated string. No patched version has been released.
Affected products
- Sunwood AI Labs GitHub Kanban MCP Server through 0.2.0
Timeline
- 2025-07-15: disclosed
- 2025-07-14: advisory: NVD entry published