Threats affecting pkg:github/hypermodel-labs/mcp-server-auto-commit

CVE-2026-4198 is a command injection vulnerability in hypermodel-labs mcp-server-auto-commit version 1.0.0, specifically in the getGitChanges function of index.ts. The flaw allows an attacker with local access and low privileges to execute arbitrary commands on the host system. Exploitation does not require user interaction but is limited to local attack vectors. Although the vulnerability has a medium CVSS score of 4.8, it poses a risk to confidentiality, integrity, and availability due to potential command execution. The vendor has been notified but has not yet responded, and a patch is available to remediate the issue. No known exploits are currently in the wild.