CVE-2026-7628 | crazyrabbitLTC mcp-code-review-server up to 0.1.0 RepoMix Command src/repomix.ts executeRepomix command injection

A vulnerability has been found in crazyrabbitLTC mcp-code-review-server up to 0.1.0 and classified as critical. This issue affects the function executeRepomix of the file src/repomix.ts of the component RepoMix Command Handler. Performing a manipulation results in command injection.

This vulnerability was named CVE-2026-7628. The attack may be initiated remotely. In addition, an exploit is available.

The project was informed of the problem early through a pull request but has not reacted yet.