A flaw has been found in Braffolk mcp-summarization-functions up to 0.1.5. This impacts an unknown function of the file src/server/mcp-server.ts of the component summarize_command. Executing a manipulation of the argument command can lead to os command injection. The attack requires local access. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-5619 is an OS command injection vulnerability in Braffolk mcp-summarization-functions up to version 0.1.5 affecting the summarize_command function. The flaw allows local attackers to execute arbitrary OS commands by manipulating the command argument.
يؤثر هذا الضعف على مكون summarize_command في ملف src/server/mcp-server.ts ويسمح بحقن أوامر نظام التشغيل من خلال معالجة غير آمنة لوسائط الأوامر. يتطلب الاستغلال وصولاً محلياً والاستغلال متاح بالفعل للجمهور.
This vulnerability in Braffolk mcp-summarization-functions versions up to 0.1.5 permits OS command injection through the summarize_command function. Local attackers can exploit this by manipulating command arguments to execute arbitrary operating system commands.
Update Braffolk mcp-summarization-functions to version 0.1.6 or later immediately. Implement strict input validation and sanitization for all command arguments. Apply principle of least privilege to limit local access. Monitor and restrict execution of the summarize_command function.
قم بتحديث Braffolk mcp-summarization-functions إلى الإصدار 0.1.6 أو أحدث فوراً. طبق التحقق الصارم من صحة المدخلات وتنظيفها لجميع وسائط الأوامر. طبق مبدأ أقل صلاحية لتقييد الوصول المحلي. راقب وقيد تنفيذ وظيفة summarize_command.