---
id: CVE-2026-106764
aliases:
  - GHSA-jwc4-922r-f2rw
title: >-
  @rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch
  function
summary: >-
  @rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch
  function
severity: high
cvss: 7.5
cwe:
  - CWE-77
  - CWE-94
vendor: rog0x
product: '@rog0x/mcp-git-tools'
ecosystem: npm
affected:
  - '@rog0x/mcp-git-tools <= 1.0.1'
published: '2026-10-23'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T20:58:05Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-jwc4-922r-f2rw'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106764'
  - url: 'https://github.com/rog0x/mcp-git-tools/issues/1'
  - url: 'https://stillosdigitalholdings.com/advisories/CVE-2026-106764.cve.json'
  - url: 'https://www.npmjs.com/package/@rog0x/mcp-git-tools'
  - url: 'https://github.com/advisories/GHSA-jwc4-922r-f2rw'
tags:
  - ghsa
  - npm
  - cve.org
epss: 0.00524
epssPercentile: 0.44398
ingestedAt: '2026-10-23T15:29:36.880Z'
---

## Overview

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.

## Affected packages

- `@rog0x/mcp-git-tools <= 1.0.1`

## Remediation

Refer to the advisory for the patched release.