Command injection in Sunwood-ai-labs github-kanban-mcp-server
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.
Summary
The github-kanban-mcp-server package by Sunwood-ai-labs is affected in versions from 0.1 before 0.4.1. The handleListIssues function in src/handlers/issue-handlers.ts does not neutralize the state and labels arguments, which lets attacker-supplied input reach an operating system command (CWE-78). A remote attacker with no privileges can exploit this, but a user must interact with the crafted input.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
Description from the CNA
A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue. The name of the patch is 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae. It is suggested to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sunwood-ai-labs | github-kanban-mcp-server | 0.1; 0.2; 0.3; 0.4.0 | 0.4.1 | Patch available | CNA |
- github-kanban-mcp-server VendorSunwood-ai-labs Affected 0.1; 0.2; 0.3; 0.4.0 Fixed in 0.4.1 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sunwood-ai-labs:github-kanban-mcp-server:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:sunwood-ai-labs:github-kanban-mcp-server:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
Upgrade github-kanban-mcp-server to version 0.4.1, which fixes the issue with patch 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
- Fix · CNA github-kanban-mcp-server (Sunwood-ai-labs) Fixed in 0.4.1
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116369
- 2026-10-27 Alias added: GHSA-q845-6fh7-j6h3
- 2026-10-31 CISA SSVC decision points changed
References
Patch 3
More Sunwood-ai-labs vulnerabilities
- TI-2025-33710 github-kanban-mcp-server Command Injection vulnerability CVSS 4.0HIGH 8.9
- TI-2026-06676 Sunwood-ai-labs command-executor-mcp-server MCP index.ts execute_command os command injection CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-116369 · CVE Program
- CVE-2026-116369 · NVD
- FIRST EPSS
- GHSA-q845-6fh7-j6h3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences