CVE-2026-19282: llm_memory_mcp Command Injection RCE Flaw

CVE-2026-19282 Overview

CVE-2026-19282 is a command injection vulnerability in the andreahaku/llm_memory_mcp project, an open-source MCP server used to persist memory for LLM workflows. The flaw resides in the auto.capture function within src/autolearn/GitHooksManager.ts. An attacker with local access can manipulate the hash argument to trigger command injection [CWE-74]. The project does not use formal versioning, so all builds up to commit f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0 are affected. The maintainer was notified through a GitHub issue but has not responded at the time of disclosure.

Critical Impact
Local attackers can inject arbitrary operating system commands through the hash parameter processed by the Git hooks manager, executing with the privileges of the user running the MCP server.

Affected Products

andreahaku/llm_memory_mcp up to commit f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0
Component: llm_memory_mcp (src/autolearn/GitHooksManager.ts)
No versioned releases exist for this project

Discovery Timeline

2026-08-08 - CVE-2026-19282 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19282

Vulnerability Analysis

The vulnerability affects the auto.capture function inside src/autolearn/GitHooksManager.ts, which handles Git hook events for the memory MCP server. The hash argument, expected to represent a Git commit identifier, is passed into a shell command context without adequate sanitization. Because the input flows into command execution, an attacker who controls the hash value can append shell metacharacters and execute arbitrary commands. Exploitation is restricted to local execution, aligning with the CWE-74 improper neutralization classification.

Root Cause

The root cause is improper neutralization of special elements used in an OS command, categorized under [CWE-74]. The GitHooksManager component constructs a command string using the hash argument without escaping shell metacharacters or using safe execution primitives such as parameterized execFile calls. Any caller able to influence the hash value can break out of the intended argument boundary.

Attack Vector

An attacker requires local access with low privileges to reach the vulnerable code path. This typically means influencing the Git repository state, hook invocation, or MCP input that feeds into auto.capture. Once the crafted hash value is processed, injected commands execute in the shell context of the MCP server process. The scope is limited to the local machine, with no network reachability required.

No verified proof-of-concept code is published beyond the referenced GitHub Issue #21 and the VulDB entry. See the upstream llm_memory_mcp repository for the vulnerable source path.

Detection Methods for CVE-2026-19282

Indicators of Compromise

Unexpected child processes spawned by the Node.js runtime hosting llm_memory_mcp, especially shells (/bin/sh, bash, cmd.exe) invoked from the GitHooksManager code path.
Git hook invocations where the commit hash argument contains shell metacharacters such as ;, &&, |, backticks, or $().
Outbound network connections initiated by the MCP server process to unfamiliar hosts shortly after a Git hook fires.

Detection Strategies

Enable process ancestry logging on hosts running llm_memory_mcp and alert on shell processes descending from the MCP server.
Instrument or wrap child_process calls in the Node.js runtime to log the full command line passed to exec for review.
Review Git hook logs and auto.capture inputs for non-hexadecimal characters in commit hash arguments.

Monitoring Recommendations

Forward endpoint process telemetry and shell audit logs to a centralized SIEM for correlation with Git activity.
Monitor file integrity for src/autolearn/GitHooksManager.ts and other MCP scripts to detect tampering or downgrade attempts.
Track user accounts that run MCP servers for anomalous command execution outside normal development workflows.

How to Mitigate CVE-2026-19282

Immediate Actions Required

Restrict local access to systems running llm_memory_mcp and run the server under a low-privilege, non-interactive account.
Disable or remove the Git hooks integration in src/autolearn/GitHooksManager.ts until a fix is published upstream.
Validate the hash argument against a strict hexadecimal allowlist (for example, ^[a-f0-9]{7,40}$) before it reaches any command execution API.

Patch Information

At the time of publication, no vendor patch is available. The maintainer has been notified through GitHub Issue #21 but has not responded. Track the upstream llm_memory_mcp repository and the VulDB advisory for remediation updates.

Workarounds

Replace shell-based execution in GitHooksManager.ts with child_process.execFile or spawn using an argument array to eliminate shell interpretation.
Run the MCP server inside a container or sandbox with no shell binaries and a read-only filesystem where feasible.
Remove untrusted Git repositories from directories accessible to the MCP process, and audit any hook scripts before enabling auto.capture.

bash

# Configuration example: restrict hash input with an allowlist before invoking Git hooks
# Add this validation ahead of any exec() call that consumes the hash argument
case "$HASH" in
  [a-f0-9]*) ;;
  *) echo "Invalid commit hash"; exit 1 ;;
esac