OS Command Injection Vulnerability in Sunwood-ai-labs GitHub Kanban MCP Server
CVE-2026-116369

5.3MEDIUM

Key Information:

Vendor

Sunwood-ai-labs

Status
Github-kanban-mcp-server
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116369?

A vulnerability has been discovered in the Sunwood-ai-labs GitHub Kanban MCP Server, allowing attackers to execute arbitrary operating system commands through manipulated inputs. The vulnerability specifically resides in the handleListIssues function located in src/handlers/issue-handlers.ts. By exploiting this flaw, attackers can launch remote commands, potentially compromising the security of the server. Users are advised to upgrade to version 0.4.1, which includes a patch (commit 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae) to remediate this issue.

Affected Version(s)

github-kanban-mcp-server 0.1

github-kanban-mcp-server 0.2

github-kanban-mcp-server 0.3

References

https://vuldb.com/vuln/426333
vdb-entrytechnical-description
https://vuldb.com/vuln/426333/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116369
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

h4ckwither (VulDB User)
.