Executive brief
llm_memory_mcp is a memory management server for AI-powered coding workflows. An attacker can inject arbitrary operating system commands by crafting a malicious Git commit hash parameter, allowing them to execute code with the privileges of the server process on the local system.
Technical details
The vulnerability is a command injection flaw in the auto.capture operation within src/autolearn/GitHooksManager.ts. The function accepts a caller-controlled commit hash parameter and interpolates it directly into shell commands executed via Node.js execSync() without validation or escaping. An attacker can craft a hash string containing shell metacharacters (e.g., "&" or pipes) to inject arbitrary OS commands. The vulnerable code executes multiple git show commands with the unsanitized hash, such as `git show -s --format="..." ${commitHash}`. Attack requires local network access to the MCP server and knowledge that auto-learning has been initialized for a Git repository. Successful exploitation grants arbitrary command execution with the server process privileges.
Affected products
- andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0
Timeline
- 2026-08-08: disclosed: Published on NVD