GitHub Kanban MCP Server Command Injection Gets a CVE Four Months After Fix

An MCP server that wraps the GitHub CLI has been given a CVE, and the interesting part is the timeline, not the score. CVE-2026-116369 was published to NVD on October 26, 2026. The fix it points to was committed on June 22.

What the record says

The affected project is github-kanban-mcp-server from Sunwood-ai-labs, which lets an agent list, create and comment on GitHub issues by shelling out to the gh command. NVD’s description says versions up to 0.4.0 are affected, specifically the handleListIssues function in src/handlers/issue-handlers.ts. Manipulating the state or labels argument leads to OS command injection, and the attack can be launched remotely. The weakness list on the record is CWE-77 and CWE-78.

The scores on the NVD record were set by the VulDB CNA, not by NIST, whose status for the record was “Deferred” when we looked: CVSS 3.1 6.3 (medium), CVSS 4.0 5.3 (medium) and CVSS 2.0 7.5 (high). None of them is rated critical. The 3.1 vector includes “user interaction required”, which is worth reading as a hint about how VulDB modeled the attack, not as a finding we verified.

What the fix changed

The patch commit is titled “fix: prevent gh command injection”. Reading the diff, the old issue-listing code built one command string from the repository, a --state flag and a --label flag (the label flag joined args.labels with commas) and ran it through child_process.exec. The new code builds an argument array and runs execFile('gh', args), so the shell never parses the values. The commit also adds validation: regex checks for repository name and issue number in comment-handlers.ts, and an integer check on the issue number in issue-handlers.ts. The pre-fix create, update, comment and label handlers also interpolated into shell strings according to the diff, but the CVE names only handleListIssues and we do not claim the others were exploitable.

That is the standard remedy, and it matches the v0.4.1 release notes, which say the release removes shell-string gh execution from issue, label and comment handlers.

Why the date gap matters

NVD says upgrading to 0.4.1 is recommended. That release is dated June 22, 2026, and a 0.4.2 tag followed three minutes later; the maintainer’s pull request comments describe 0.4.2 as review follow-ups (issue number handling and unique temp filenames), not a new exploit. The CVE appeared four months after the fix.

A public GitHub issue (number 26) opened on March 8, 2026 is a follow-up from a reporter who says they filed a private advisory on February 2, referenced as GHSA-74w8-44v9-4hmq, and had no response after more than 30 days, before moving toward a CVE request. We read that as the reporter’s account. We could not open the private advisory (the page returns 404, which fits an unpublished advisory but is our inference). The v0.4.1 notes cite a different ID (GHSA-x662-2jpv-5ghf), which the maintainer’s pull request thanks a different GitHub user for, and the issue 26 reporter calls their report separate from an earlier published advisory, GHSA-6jx8-rcjx-vmwf. That points to more than one reporter, though we cannot confirm the reports are distinct. Counting from that February 2 filing, the wait was nearly five months. We also do not know who requested this CVE.

This is also not the project’s first command injection record. GHSA-6jx8-rcjx-vmwf corresponds to CVE-2025-53818 (published July 12, 2025), and NVD lists CVE-2026-0756 (January 23, 2026), which describes an execAsync injection in the create_issue parameters; we read only its NVD description.

What we can say is that anyone who tracks MCP servers by CVE feed would have heard about this long after a fix existed. Anyone who pinned an older version and waited for an alert was unprotected in the meantime.

How an attack would work

This is our reasoning, not something the record states. The MCP pattern is that a model decides which tool to call and fills in the arguments. If the model has read attacker-controlled text, such as an issue body, a web page or a pull request description, an injected instruction can steer those arguments. A labels value containing shell metacharacters then lands in the command line. The server runs with the privileges of whoever launched it, usually a developer with a logged-in gh session and local files.

In our judgement, a medium score undersells the setup. The flaw is only as dangerous as the agent that feeds it, and that part is outside the CVSS vector.

What to do

• Search your MCP and IDE configs for github-kanban-mcp-server and upgrade to 0.4.1 or later. The npm package is stuck at 0.3.0 (last published December 2024), so install from the GitHub tag.
• Look at other MCP servers that shell out. The same code pattern, string interpolation into exec, is easy to grep for.
• Run servers with a narrowly scoped GitHub token, not your personal one.
• Treat tool arguments as untrusted input in your own servers: use argument arrays and allowlist validation.

What we do not know

We found no evidence of exploitation as of October 27, 2026 in the NVD record or the project’s GitHub issue and release pages. The CISA KEV feed released on October 26, 2026 (22:24 UTC) has no entry for this CVE. VulDB’s page blocked our fetch, so we did not read it. The GitHub repository shows 10 stars, so usage is probably small, and npm reported about 109 downloads of the older package in the 30 days to October 26 (which may include bots and mirrors), but we did not measure installs of the GitHub releases. We did not test the exploit.

References

• NVD — CVE-2026-116369
• GitHub — fix commit 253d93b “fix: prevent gh command injection”
• GitHub — v0.4.1 release notes
• GitHub — issue 26, follow-up on the private advisory
• VulDB — CVE-2026-116369 (the CNA’s entry, linked from NVD; blocked our fetch, not read by us)