High severity8.1NVD Advisory· Published May 11, 2026· Updated May 13, 2026

CVE-2026-30635

Description

Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka view) in the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGE_BASE_URL.

Affected products

Oven Sh/Automagik Genieinferred2 versions
= 2.5.27+ 1 more
- (no CPE)range: = 2.5.27
- (no CPE)range: ==2.5.27
Package: https://npmjs.com/package/automagik-genie

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

gist.github.com/spdc-elm/3ddecd10ffa85c5963ab7fe531619875nvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000