High · 7.5 CVE-2026-106764 EUVD-2026-109095GHSA-jwc4-922r-f2rw

@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function

Published Oct 23, 2026 · Updated Oct 29, 2026 · Assigned by mitre

Description

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.

Ecosystem	Package	Affected	Fixed	Record
npm	@rog0x/mcp-git-tools	<= 1.0.1	—	GHSA-jwc4-922r-f2rw