CVE-2026-116369 Sunwood-ai-labs github-kanban-mcp-server issue-handlers.ts handleListIssues os command injection

Medium 5.3 Published 26 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116369?

CVE-2026-116369 is a medium-severity vulnerability in Sunwood-ai-labs github-kanban-mcp-server, published on 26 Oct 2026.

Official description

A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue. The name of the patch is 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae. It is suggested to upgrade the affected component.

Weakness: CWE-78, CWE-77

Which versions are affected by CVE-2026-116369?

How do I fix CVE-2026-116369?

No fix has been published for CVE-2026-116369 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116369 being exploited?

There is no known exploitation of CVE-2026-116369 in the wild and no public exploit code.

Sources

Also known as GHSA-q845-6fh7-j6h3.