Cyanheads vulnerabilities
We track 2 vulnerabilities in Cyanheads products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 4, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest Cyanheads vulnerabilities
- 7.5 High severity
git-mcp-server: Improper Neutralization of Argument Delimiters in a Command
git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside
- 7.5 High severity
git-mcp-server: Improper Neutralization of Special Elements used in a Command
@cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories. Prior to version 2.1.5, there is a command injection vulnerability caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacke