CVE-2026-30635

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30635
Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka view) in the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGE_BASE_URL.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/spdc-elm/3ddecd10ffa85c5963ab7fe531619875
https://gist.github.com/spdc-elm/3ddecd10ffa85c5963ab7fe531619875
Configurations

No configuration.

History

12 May 2026, 14:17

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1
CWE CWE-78
References () https://gist.github.com/spdc-elm/3ddecd10ffa85c5963ab7fe531619875 - () https://gist.github.com/spdc-elm/3ddecd10ffa85c5963ab7fe531619875 -

11 May 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-11 18:16

Updated : 2026-05-13 15:46

NVD link : CVE-2026-30635

Mitre link : CVE-2026-30635

CVE.ORG link : CVE-2026-30635

JSON object : View

Products Affected

No product.

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')