Description
A vulnerability was determined in hypermodel-labs mcp-server-auto-commit 1.0.0. Affected by this vulnerability is the function getGitChanges of the file index.ts. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: f7d992c830c5f2ec5749852e66c0195e3ed7fe30. Applying a patch is the recommended action to fix this issue. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-03-15
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Command Execution
Action: Patch Now
AI Analysis

Impact

The vulnerability involves a command injection flaw in the getGitChanges function of hypermodel‑labs mcp-server-auto-commit. An attacker with local access can supply crafted input that is passed unsanitized to the operating system, allowing arbitrary command execution. This can lead to local privilege escalation or compromise of the system executing the service. The weakness is categorized as CWE‑74 and CWE‑77.

Affected Systems

The issue affects version 1.0.0 of hypermodel‑labs mcp-server-auto-commit. No other versions are publicly identified as vulnerable, but users of this exact release should verify their deployment. The product is provided by hypermodel‑labs under the product name mcp-server-auto-commit.

Risk and Exploitability

The CVSS score for this flaw is 4.8, indicating low‑to‑medium severity, and the EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack can only be performed locally; remote exploitation is not feasible according to the description. The overall risk is considered moderate, but any credentials that have local access to the environment could be abused if the patch is not applied.

Generated by OpenCVE AI on March 16, 2026 at 22:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch commit f7d992c830c5f2ec5749852e66c0195e3ed7fe30 that fixes the command injection bug.
  • Verify that the mcp‑server‑auto‑commit service is running with the patched code and that getGitChanges is not exposed to untrusted users.
  • Restrict local user access to the machine or container running the service to trusted personnel.
  • Monitor logs for suspicious command execution attempts.

Generated by OpenCVE AI on March 16, 2026 at 22:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 17 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Hypermodel-labs
Hypermodel-labs mcp-server-auto-commit
Vendors & Products Hypermodel-labs
Hypermodel-labs mcp-server-auto-commit

Mon, 16 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 16 Mar 2026 00:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in hypermodel-labs mcp-server-auto-commit 1.0.0. Affected by this vulnerability is the function getGitChanges of the file index.ts. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: f7d992c830c5f2ec5749852e66c0195e3ed7fe30. Applying a patch is the recommended action to fix this issue. The project was informed of the problem early through an issue report but has not responded yet.
Title hypermodel-labs mcp-server-auto-commit index.ts getGitChanges command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:TF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Hypermodel-labs Mcp-server-auto-commit
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-16T20:08:37.689Z

Reserved: 2026-03-15T08:29:28.279Z

Link: CVE-2026-4198

cve-icon Vulnrichment

Updated: 2026-03-16T20:08:32.601Z

cve-icon NVD

Status : Deferred

Published: 2026-03-16T14:20:04.360

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-4198

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-23T14:01:05Z

Weaknesses