github-kanban-mcp-server Command Injection Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in github-kanban-mcp-server. This issue arises from improper validation of user-supplied strings in the create_issue parameter, allowing remote attackers to execute arbitrary code on affected installations. The executed code runs in the context of the service account. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running under the service account's privileges.

Remediation

Due to the nature of this vulnerability, the primary recommendation is to limit interactions with the product.