Executive brief
automagik-genie is a tool used to integrate AI agents with development workflows. A security flaw in its server component allows an attacker to execute unauthorized commands on the host system. This occurs if the tool is configured to connect to a malicious or compromised backend server, potentially leading to full system takeover or theft of sensitive development data.
Technical details
A command injection vulnerability exists in the automagik-genie MCP Server within the readTranscriptFromCommit function in dist/mcp/server.js. The vulnerability is a second-order injection where the application fetches task data (container_ref and after_head_commit) from a Forge API backend and interpolates these values directly into a shell command executed via execSync(). Specifically, the commitSha parameter is interpolated unquoted, allowing for unrestricted shell metacharacter injection. While the attack complexity is high because it requires the attacker to control the Forge API response (via MITM, backend compromise, or social engineering of the FORGE_BASE_URL), successful exploitation results in arbitrary code execution with the privileges of the MCP server process.
Affected products
- automagik-dev automagik-genie 2.5.27
Timeline
- 2026-02-13: other: Vulnerability discovered and PoC created
- 2026-05-11: advisory: Published to GitHub Advisory Database and NVD