@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function

Summary

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.

Remediation

1. Inventory every @rog0x/mcp-git-tools deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://github.com/advisories/GHSA-jwc4-922r-f2rw
• Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-106764
• Referencehttps://github.com/rog0x/mcp-git-tools/issues/1
• Referencehttps://stillosdigitalholdings.com/advisories/CVE-2026-106764.cve.json
• Referencehttps://www.npmjs.com/package/@rog0x/mcp-git-tools