CVE-2026-30635 Overview
CVE-2026-30635 is a command injection vulnerability [CWE-78] in automagik-genie version 2.5.27 MCP Server. The flaw resides in the readTranscriptFromCommit function within dist/mcp/server.js. Attackers can execute arbitrary operating system commands through the view_task (also known as view) operation when a user reads from an external FORGE_BASE_URL. Exploitation requires no authentication and no user interaction, but the attack complexity is high because the victim must read from an attacker-controlled forge endpoint. Successful exploitation results in arbitrary command execution on the host running the MCP Server, compromising confidentiality, integrity, and availability.
Critical Impact
Remote attackers can execute arbitrary OS commands on systems running automagik-genie 2.5.27 MCP Server by tricking it into reading from a malicious FORGE_BASE_URL.
Affected Products
- automagik-genie 2.5.27 MCP Server
- The readTranscriptFromCommit function in dist/mcp/server.js
- Deployments exposing the view_task (view) operation to external FORGE_BASE_URL values
Discovery Timeline
- 2026-05-11 - CVE-2026-30635 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-30635
Vulnerability Analysis
The automagik-genie MCP Server exposes a view_task operation that retrieves transcript data tied to a Git commit. The handler invokes readTranscriptFromCommit in dist/mcp/server.js, which constructs a shell command using values derived from an external FORGE_BASE_URL. Because the input is concatenated into a shell invocation without proper sanitization or argument separation, an attacker who controls the forge URL or its responses can embed shell metacharacters that the underlying shell interprets as additional commands. The Model Context Protocol (MCP) server typically runs with the privileges of the developer or service account using the tool, so arbitrary command execution translates directly into local code execution on the host.
Root Cause
The root cause is the use of an unsanitized external input within an operating system command invocation, classified as Improper Neutralization of Special Elements used in an OS Command [CWE-78]. Data sourced from a remote FORGE_BASE_URL reaches a shell execution path inside readTranscriptFromCommit without input validation, allowlisting, or use of safe argument-passing APIs.
Attack Vector
The attack vector is network-based. An attacker hosts or controls a malicious forge endpoint and induces a user of automagik-genie 2.5.27 to invoke the view_task (view) operation against that endpoint. When the MCP Server fetches the transcript referenced by a commit, attacker-supplied content containing shell metacharacters is passed into the vulnerable command-building routine. The shell then executes the injected payload with the privileges of the MCP Server process. Refer to the GitHub Gist PoC for technical reproduction details.
Detection Methods for CVE-2026-30635
Indicators of Compromise
- Unexpected child processes spawned by the Node.js process running dist/mcp/server.js, particularly shells (sh, bash, cmd.exe) or interpreters (curl, wget, python, nc).
- Outbound network connections from the MCP Server host to non-corporate or newly registered domains shortly after a view_task invocation.
- FORGE_BASE_URL environment values pointing to external or unverified hosts in process or configuration telemetry.
Detection Strategies
- Monitor process lineage for node parents spawning shell interpreters and correlate with MCP Server activity windows.
- Inspect command-line arguments of child processes for shell metacharacters such as ;, |, `, $(, and && adjacent to commit identifiers or URL fragments.
- Apply file integrity monitoring on dist/mcp/server.js to detect tampering and confirm the installed version against patched releases.
Monitoring Recommendations
- Log all invocations of the view_task and view MCP operations along with the resolved FORGE_BASE_URL value.
- Alert on any FORGE_BASE_URL value not present in an explicit allowlist of trusted internal forges.
- Capture outbound DNS and HTTP telemetry from hosts running automagik-genie to identify command-and-control beacons following exploitation.
How to Mitigate CVE-2026-30635
Immediate Actions Required
- Identify all systems running automagik-genie 2.5.27 and restrict use of the view_task operation until a patched version is deployed.
- Constrain FORGE_BASE_URL to internal, trusted hosts only and reject external URLs at the network or proxy layer.
- Run the MCP Server as a low-privilege, non-root account inside a sandbox or container to limit blast radius if exploitation occurs.
Patch Information
No vendor advisory or patched version is listed in the NVD record at publication. Monitor the automagik-genie project references and upstream repository for a fixed release, then upgrade beyond 2.5.27 once published. The fix should replace shell-based execution in readTranscriptFromCommit with safe argument-passing APIs and validate any data derived from FORGE_BASE_URL.
Workarounds
- Disable or remove the view_task (view) handler from dist/mcp/server.js deployments until a patched release is available.
- Enforce an allowlist of approved FORGE_BASE_URL values via configuration management and block all other destinations at the egress proxy.
- Apply egress filtering so the MCP Server host cannot reach arbitrary internet destinations, reducing the value of a successful injection.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
