CVE-2025-53818: Sunwood-Ai-Labs GitHub-Kanban-Mcp-Server

High severity, CVSS 8.9. EPSS: 1.4% chance of exploitation in the next 30 days.

GitHub Kanban MCP Server is a Model Context Protocol (MCP) server for managing GitHub issues in Kanban board format and streamlining LLM task management. Version 0.3.0 of the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP Server exposes the tool `add_comment` which relies on Node.js child process API `exec` to execute the GitHub (`gh`) command, is an unsafe and vulnerable API if concatenated with untrusted user input. As of time of publication, no known patches are available.

Affected products

Published 2025-07-14. Last modified 2026-06-17.