CVE-2026-106764highCode execution2026-10-23

CVE-2026-106764 and CVE-2026-106763: command injection in the mcp-git-tools and sagemath-mcp-server MCP servers, no patched versions

GitHub published advisories on 23 October 2026 for two npm MCP servers that let tool arguments reach a shell. In @rog0x/mcp-git-tools 1.0.1 and earlier, the base branch value is injected into a git command, and in @justice8096/sagemath-mcp-server 1.0.1 and earlier, its string escaping and code sanitizing can be bypassed to run commands in local Sage mode. Neither has a fixed version, so remove them or run them only in a sandbox.

01.

What it is

CVE-2026-106764 (GHSA-jwc4-922r-f2rw): resolveBaseBranch in @rog0x/mcp-git-tools <=1.0.1 puts the caller's branch value into a shell command, so a prompt-injected agent or malicious MCP client can run commands as the server user.

CVE-2026-106763 (GHSA-2vq3-mpmf-9xgr): escapeShellString and sanitizeCode in @justice8096/sagemath-mcp-server <=1.0.1 can be bypassed, giving command execution when the server runs Sage locally. The Docker mode isn't affected according to the report.

Both issues were reported to the maintainers on 23 September 2026 and no patched release exists.

02.

How to check

Search your MCP client configs (Claude Desktop, Cursor, Windsurf, Claude Code and others) and package.json files for @rog0x/mcp-git-tools or @justice8096/sagemath-mcp-server.

03.

How to fix

Remove these servers from your MCP configs until fixed versions ship.
If you must keep sagemath-mcp-server, run it in its Docker mode rather than with a local Sage install.
Run community MCP servers in a container or sandbox with no access to your keys or home directory.

# find either server in common MCP config locations
grep -rlE 'mcp-git-tools|sagemath-mcp-server' ~/.cursor ~/.config ~/Library/Application\ Support/Claude 2>/dev/null

04.

Sources

More advisories for this tool