What happened
An OS command injection in github-kanban-mcp-server's handleListIssues (state/labels arguments reach a shell invocation) allows remote code execution. CVSS 6.3, published 2026-10-26.
Why it matters
An MCP server exposed to an LLM agent gives the agent (and any prompt-injected instruction) a command-execution primitive on the host. This is a direct agent-tool-to-RCE path.
Attack vector
The state/labels arguments to handleListIssues are assembled into an OS shell command without safe quoting, allowing a remote caller (or an LLM agent invoking the tool) to inject shell commands and execute code on the host running the MCP server.
Affected systems
Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0 (src/handlers/issue-handlers.ts, handleListIssues).
Mitigation
Upgrade to the patched version; avoid passing untrusted state/labels values and quote/validate shell arguments.