Gdegrange

The `decodeUriComponent` function in `index.js` uses a fallback mechanism called `customDecodeURIComponent` when native decoding fails. This fallback process identifies every distinct percent-encoded sequence and performs a full-string regular-expression replacement for each one. When provided with malformed input containing numerous distinct sequences, the number of replacements and the length of the scanned input increase simultaneously. This results in quadratic CPU consumption, which can block the Node.js event loop. While URL header limits may reduce the delay, inputs within the request body can reach sizes that trigger this behavior.

Remote Model Context Protocol servers are susceptible to cross-service bearer token replay. This occurs because the server-side bearer authentication fails to validate the audience (`aud`) of the token. In environments where a single authorization server issues tokens for multiple services, a token intended for a different service may be incorrectly accepted by the MCP server. This issue affects servers utilizing the `requireBearerAuth()` or `verifyBearerToken()` functions if the `verifyAccessToken()` function does not independently validate the `aud` claim.

The default `blockUnsafeOperationsPlugin` compares parsed option names with literal dangerous option spellings, but Git accepts unambiguous long-option abbreviations. This allows attacker-influenced push arguments, such as abbreviated forms of `--receive-pack` or `--exec`, to bypass the `detectVulnerableFlags` function. Consequently, Git may invoke an attacker-selected command when these arguments are passed to a local or file remote, or an attacker-influenced receive-pack target.