CVE-2026-116369: Sunwood-ai-labs github-kanban-mcp-server issue-handlers.ts handleListIssues os command injection
A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue. The name of the patch is 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sunwood-ai-labs/github-kanban-mcp-serverto a version that resolves this vulnerability.Fixed in 0.4.1Patch 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae
Event History
Frequently Asked Questions
Which deployments are affected?
Sunwood-ai-labs github-kanban-mcp-server versions up to and including 0.4.0 are affected. Version 0.4.1 is recommended to address the issue.
What input must an attacker control to exploit this issue?
An attacker must be able to manipulate the state or labels arguments handled by handleListIssues in src/handlers/issue-handlers.ts. The vulnerability can be exploited remotely and does not require privileges according to the supplied severity vector.
What should be done if the component cannot be upgraded immediately?
The provided data recommends upgrading the affected component to version 0.4.1. No alternative mitigation or configuration workaround is specified.
How can I verify that the remediation is applied?
Confirm that github-kanban-mcp-server has been upgraded to version 0.4.1 or later. The supplied patch is identified as commit 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae.