CVE-2026-5125

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-5125

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5125.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-5125

Published

2026-03-30T17:00:13.107Z

Modified

2026-07-08T08:09:52.304537164Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

raine consult-llm-mcp server.ts child_process.execSync os command injection

Details

A vulnerability was detected in raine consult-llm-mcp up to 2.5.3. Affected by this vulnerability is the function childprocess.execSync of the file src/server.ts. The manipulation of the argument gitdiff.baseref/gitdiff.files results in os command injection. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 2.5.4 addresses this issue. The patch is identified as 4abf297b34e5e8a9cb364b35f52c5f0ca1d599d3. Upgrading the affected component is recommended.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5125.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ]
}

References

Affected packages

Git / github.com/raine/consult-llm

Affected ranges

Type

GIT

Repo

https://github.com/raine/consult-llm

Events

Introduced

c310fe4f2a45863c6d2b34995521a55741f5b1ef

Fixed

4abf297b34e5e8a9cb364b35f52c5f0ca1d599d3

Fixed

2210bea4394a1640c655d5ede22b5d630ea0c318

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.5.0"
        },
        {
            "last_affected": "2.5.0"
        },
        {
            "introduced": "2.5.1"
        },
        {
            "last_affected": "2.5.1"
        },
        {
            "introduced": "2.5.2"
        },
        {
            "last_affected": "2.5.2"
        },
        {
            "introduced": "2.5.3"
        },
        {
            "last_affected": "2.5.3"
        }
    ]
}

Affected versions

2.*

2.5.0

2.5.1

2.5.2

2.5.3

v2.*

v2.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5125.json"