What happened
CVE-2026-106764 (published 2026-10-23, NVD Deferred) is an arbitrary code execution issue in the mcp-git-tools MCP server, reachable through the resolveBaseBranch function when processing attacker-controlled git tool arguments.
Why it matters
Agentic tool-surface RCE: a git-for-agent MCP server that builds shell commands from untrusted branch values gives an agent or its prompt-supplier the ability to run code on the developer/infrastructure host.
Attack vector
A crafted branch/ref value supplied to the resolveBaseBranch function (used when a git tool call must resolve a base branch) reaches a shell or command invocation without adequate escaping, letting an agent-driven request execute arbitrary code on the host.
Affected systems
@rog0x/mcp-git-tools 1.0.1
Mitigation
No fixed release documented (NVD Deferred). If deployed, restrict which agent hosts may call it and run within a least-privilege container; watch for unusual branch names reaching the tool.