Executive brief
Kirachon context-engine is a code analysis tool used for repository indexing and semantic retrieval. A command injection vulnerability in the git diff functionality allows attackers to execute arbitrary commands on the system by manipulating arguments passed to git operations.
Technical details
The vulnerability is a command injection in the execGitCommand function within src/mcp/utils/gitUtils.ts, specifically in the review-git-diff endpoint. Insufficient input validation on the args parameter allows attackers to inject shell metacharacters and execute arbitrary system commands. The attack requires network access to the endpoint but no authentication. The fix (commit e0729dcfd3a2b1682a7bff86e7174852c03419ba) introduces input validation including length checks (GIT_REF_MAX_LENGTH, GIT_PATH_PATTERN_MAX_LENGTH) and a safe git reference pattern regex to sanitize git references before passing them to shell execution. Version 1.9.1 and later contain the patch.
Affected products
- Kirachon context-engine up to 1.9.0
Timeline
- 2026-08-08: disclosed: CVE-2026-19266 published
- 2026-04-26: patched: Fix committed to repository