Vulnerability · Published Aug 8, 2026 · Assigned by VulDB

CVE-2026-19266Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection

Medium 5.5

In plain English

A medium-severity command injection in context-engine from Kirachon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)3.9%top 9.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1 mitigates this issue. This patch is called e0729dcfd3a2b1682a7bff86e7174852c03419ba. It is advisable to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
Kirachon	context-engine	1.01.11.21.31.41.51.61.7

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References

VDB-387011 | Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection vdb-entry, technical-description
VDB-387011 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-19266 | CVE Analysis and Report third-party-advisory
Submit #865221 | Kirachon context-engine unknown Command Injection third-party-advisory
https://github.com/Kirachon/context-engine/issues/16 issue-tracking
https://github.com/Kirachon/context-engine/issues/16#issuecomment-4321217057 issue-tracking
https://github.com/Kirachon/context-engine/commit/e0729dcfd3a2b1682a7bff86e7174852c03419ba patch
https://github.com/Kirachon/context-engine/releases/tag/v1.9.1 patch
https://github.com/Kirachon/context-engine/ product