CVE-2026-19266: Kirachon Context-Engine RCE Vulnerability

CVE-2026-19266 Overview

CVE-2026-19266 is a command injection vulnerability in Kirachon context-engine versions up to and including 1.9.0. The flaw resides in the execGitCommand function within src/mcp/utils/gitUtils.ts, which is reached through the review-git-diff endpoint. An authenticated attacker on an adjacent network can manipulate the args argument to inject arbitrary operating system commands. The maintainer addressed the issue in version 1.9.1 through commit e0729dcfd3a2b1682a7bff86e7174852c03419ba, which introduces strict validation of git reference inputs. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
A low-privileged attacker with adjacent network access can inject shell commands into git operations, resulting in confidentiality, integrity, and availability impact on the host running the context-engine service.

Affected Products

Kirachon context-engine versions 1.0.0 through 1.9.0
The review-git-diff MCP endpoint exposed by context-engine
Deployments consuming the execGitCommand function in src/mcp/utils/gitUtils.ts

Discovery Timeline

2026-08-08 - CVE-2026-19266 published to NVD
2026-08-12 - Last updated in NVD database
2026-08-14 - EPSS score published at 1.516% (72.28 percentile)

Technical Details for CVE-2026-19266

Vulnerability Analysis

The context-engine project exposes a Model Context Protocol (MCP) endpoint named review-git-diff that invokes git operations on behalf of clients. Internally, the endpoint calls execGitCommand in src/mcp/utils/gitUtils.ts and forwards the caller-supplied args parameter into a git subprocess. Before version 1.9.1, the code did not validate that these arguments were legitimate git references, branch names, or commit hashes. An attacker able to reach the endpoint can supply crafted values that git or the underlying shell interprets as option flags or additional commands. Because git accepts many arguments that trigger external process execution (for example, options that invoke pagers or external filters), argument smuggling here escalates to full command injection on the host.

Root Cause

The root cause is missing input neutralization before invoking a downstream component, which matches [CWE-74]. The pre-patch execGitCommand accepted any string as a git reference. There was no allow-list, no length cap, and no rejection of leading dashes that git treats as options. The patch demonstrates the intended defense: a strict regular expression, length bounds, and rejection of dangerous substrings.

Attack Vector

Exploitation requires adjacent network access and low privileges on the MCP endpoint. No user interaction is required. An attacker submits a review-git-diff request with an args value crafted to break out of the expected git reference context, either by prepending - to be interpreted as a git option, embedding .. sequences, or abusing @{ revision syntax to trigger unintended behavior.

typescript

// Patch from src/mcp/utils/gitUtils.ts introducing safe-ref validation
const GIT_REF_MAX_LENGTH = 1024;
const GIT_PATH_PATTERN_MAX_LENGTH = 4096;
const SAFE_GIT_REF_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/@-]*$/;

function validateSafeGitRef(value: unknown, fieldName: string): string {
  if (typeof value !== 'string') {
    throw new Error(`Invalid git ${fieldName}: must be a safe branch name or commit hash`);
  }

  const trimmed = value.trim();
  if (
    trimmed.length === 0 ||
    trimmed.length > GIT_REF_MAX_LENGTH ||
    trimmed !== value ||
    !SAFE_GIT_REF_PATTERN.test(trimmed) ||
    trimmed.startsWith('-') ||
    trimmed.endsWith('.') ||
    trimmed.endsWith('/') ||
    trimmed.includes('..') ||
    trimmed.includes('@{') ||
    trimmed.includes('//') ||
    trimmed.split('/').some((segment) => segment.length === 0 || segment.endsWith('.lock'))
  ) {
    throw new Error(`Invalid git ${fieldName}: must be a safe branch name or commit hash`);
  }

  return trimmed;
}
// Source: https://github.com/Kirachon/context-engine/commit/e0729dcfd3a2b1682a7bff86e7174852c03419ba

Detection Methods for CVE-2026-19266

Indicators of Compromise

Requests to the review-git-diff endpoint containing arguments that begin with -, contain .., @{, //, or exceed 1024 characters.
Child processes spawned by the context-engine Node.js process that are not git, or git invocations with unexpected subcommands such as --upload-pack or --exec.
Unusual outbound network connections initiated by the account running context-engine shortly after MCP requests.

Detection Strategies

Inspect application logs for execGitCommand invocations that failed validation after upgrading, indicating probing activity.
Correlate HTTP access logs for the MCP review-git-diff route with process-creation telemetry on the host to identify shell or interpreter spawns.
Deploy runtime rules that flag any non-git child of the context-engine process tree.

Monitoring Recommendations

Enable verbose audit logging on the context-engine service, including full request bodies for MCP endpoints.
Forward process creation, command line, and parent-child relationships to a central logging platform for retrospective hunting.
Alert on git executions with arguments matching the disallow patterns enumerated in validateSafeGitRef.

How to Mitigate CVE-2026-19266

Immediate Actions Required

Upgrade Kirachon context-engine to version 1.9.1 or later, which contains commit e0729dcfd3a2b1682a7bff86e7174852c03419ba.
Restrict network exposure of the MCP endpoint to trusted management segments and authenticated principals only.
Rotate any credentials, tokens, or SSH keys accessible to the context-engine process if compromise is suspected.

Patch Information

The fix is published in the GitHub Release v1.9.1 and implemented in commit e0729dcfd3. Additional context is available in the upstream issue tracker and the VulDB entry for CVE-2026-19266.

Workarounds

If patching is not immediately possible, disable the review-git-diff endpoint or block it at the reverse proxy.
Run context-engine under a dedicated, unprivileged user account with no shell login and no access to sensitive secrets.
Enforce an allow-list of branch names and commit hashes at an upstream API gateway that mirrors the SAFE_GIT_REF_PATTERN regular expression.

bash

# Upgrade to the patched release
npm install @kirachon/context-engine@1.9.1

# Or pin the fixed commit directly
npm install github:Kirachon/context-engine#e0729dcfd3a2b1682a7bff86e7174852c03419ba

# Verify the installed version
npm ls @kirachon/context-engine