CVE-2026-5125

raine consult-llm-mcp server.ts child_process.execSync os command injection

State: Published
Severity: 4.8 Medium
Published: Mar 30, 2026
Updated: Mar 31, 2026
Reserved: Mar 30, 2026

Description

A vulnerability was detected in raine consult-llm-mcp up to 2.5.3. Affected by this vulnerability is the function child_process.execSync of the file src/server.ts. The manipulation of the argument git_diff.base_ref/git_diff.files results in os command injection. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 2.5.4 addresses this issue. The patch is identified as 4abf297b34e5e8a9cb364b35f52c5f0ca1d599d3. Upgrading the affected component is recommended.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-78 OS Command Injection
CWE-77 Command Injection

Affected Products

Product	Versions
consult-llm-mcpraine	2.5.0Affected 2.5.1Affected 2.5.2Affected 2.5.3Affected 2.5.4Not affected

References

VDB-354157 | raine consult-llm-mcp server.ts child_process.execSync os command injectionvdb-entrytechnical-description
VDB-354157 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #780154 | raine consult-llm-mcp <=2.5.3 Command Injectionthird-party-advisory
https://github.com/raine/consult-llm-mcp/issues/6issue-tracking
https://github.com/user-attachments/files/25821105/consult-llm-mcp_bug.pdfexploit
https://github.com/raine/consult-llm-mcp/commit/4abf297b34e5e8a9cb364b35f52c5f0ca1d599d3patch
https://github.com/raine/consult-llm-mcp/releases/tag/v2.5.4patch
https://github.com/raine/consult-llm-mcp/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.