CVE-2026-5007 | kazuph mcp-docs-rag up to 0.5.0 add_git_repository/add_text_file src/index.ts cloneRepository os command injection

A vulnerability classified as critical has been found in kazuph mcp-docs-rag up to 0.5.0. Affected is the function cloneRepository of the file src/index.ts of the component add_git_repository/add_text_file. The manipulation leads to os command injection.

This vulnerability is documented as CVE-2026-5007. The attack needs to be performed locally. Additionally, an exploit exists.

The project was informed of the problem early through an issue report but has not responded yet.