PT-2026-69196

CVE-2026-19282

Published

2026-08-08

Updated

2026-10-23

Description by

CVSS 3.1

5.3

Medium

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions andreahaku llm memory mcp versions up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0

Description Command injection is possible through the manipulation of the hash argument within the auto.capture() function located in the src/autolearn/GitHooksManager.ts file of the llm memory mcp component. This issue is restricted to local execution.

Recommendations As a temporary workaround, consider restricting the use of the auto.capture() function until a fix is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers