High severity8.1NVD Advisory· Published May 11, 2026· Updated Jun 17, 2026

CVE-2026-30635

Description

Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka view) in the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGE_BASE_URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Npm/Automagik Genieinferred
Range: =2.5.27
Package: https://npmjs.com/package/automagik-genie
Automagik Genie/MCP Serverllm-create
Range: <2.5.27

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-64vr-4gr2-m642ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-30635ghsaADVISORY
gist.github.com/spdc-elm/3ddecd10ffa85c5963ab7fe531619875nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000