PT-2026-69188

CVE-2026-19266

Published

2026-08-08

Updated

2026-10-23

Description by

CVSS 3.1

5.5

Medium

MetricsAV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Kirachon context-engine versions prior to 1.9.1

Description Command injection is possible within the review-git-diff Endpoint due to improper handling of the args variable in the execGitCommand() function located in the src/mcp/utils/gitUtils.ts file. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server.

Recommendations Upgrade to version 1.9.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers