Vulnerability · Published Aug 8, 2026 · Assigned by VulDB

CVE-2026-19282andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injection

Medium 5.3

In plain English

A medium-severity command injection in llm_memory_mcp from andreahaku. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.1%top 35.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolearn/GitHooksManager.ts of the component llm_memory_mcp. Executing a manipulation of the argument hash can lead to command injection. The attack is restricted to local execution. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
andreahaku	llm_memory_mcp	f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-387023 | andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injection vdb-entry, technical-description
VDB-387023 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-19282 | CVE Analysis and Report third-party-advisory
Submit #865226 | andreahaku llm_memory_mcp unknown Command Injection third-party-advisory
https://github.com/andreahaku/llm_memory_mcp/issues/21 issue-tracking
https://github.com/andreahaku/llm_memory_mcp/ product