CVE-2026-19266: Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection
A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1 mitigates this issue. This patch is called e0729dcfd3a2b1682a7bff86e7174852c03419ba. It is advisable to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommandto a version that resolves this vulnerability.Fixed in 1.9.1Patch e0729dcfd3a2b1682a7bff86e7174852c03419ba
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19266?
The severity of CVE-2026-19266 is classified as medium, with a score of 5.5.
How do I fix CVE-2026-19266?
To fix CVE-2026-19266, upgrade Kirachon context-engine to version 1.9.1 or later.
What type of vulnerability is CVE-2026-19266?
CVE-2026-19266 is a command injection vulnerability.
What component is affected by CVE-2026-19266?
CVE-2026-19266 affects the review-git-diff Endpoint in the Kirachon context-engine.
What can be exploited in CVE-2026-19266?
An attacker can exploit CVE-2026-19266 by manipulating the argument in the execGitCommand function, leading to command injection.