5 min read
News Brief CVE-2026-116369 covers OS command injection in github-kanban-mcp-server up to 0.4.0, where tool arguments reached a shell. Version 0.4.1 replaced shell strings with argument arrays in June. The VulDB CNA scored it 6.3 (medium) under CVSS 3.1.