CVE-2025-53818 github-kanban-mcp-server Command Injection vulnerability
An attacker can execute arbitrary commands via the add_comment tool due to unsafe use of Node.js exec with untrusted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-53818?
CVE-2025-53818 is a high-severity command injection vulnerability in Sunwood-ai-labs github-kanban-mcp-server, published on 14 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GitHub Kanban MCP Server is a Model Context Protocol (MCP) server for managing GitHub issues in Kanban board format and streamlining LLM task management. Version 0.3.0 of the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP Server exposes the tool `add_comment` which relies on Node.js child process API `exec` to execute the GitHub (`gh`) command, is an unsafe and vulnerable API if concatenated with untrusted user input. As of time of publication, no known patches are available.
Weakness: CWE-78
Which versions are affected by CVE-2025-53818?
2 open source packages ship an affected version, including @sunwood-ai-labs/github-kanban-mcp-server.
| Package | Affected | Fixed in |
|---|---|---|
@sunwood-ai-labs/github-kanban-mcp-server npm | All versions to 0.3.0 | None |
@sunwood-ai-labs/github-kanban-mcp-server npm | All versions to 0.3.0 | None |
How do I fix CVE-2025-53818?
No fix has been published for CVE-2025-53818 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-53818 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53818 exists.
Sources
Also known as GHSA-6jx8-rcjx-vmwf.