CVE-2026-5125 | raine consult-llm-mcp up to 2.5.3 src/server.ts child_process.execSync git_diff.base_ref/git_diff.files os command injection

A vulnerability described as critical has been identified in raine consult-llm-mcp up to 2.5.3. Affected by this vulnerability is the function child_process.execSync of the file src/server.ts. The manipulation of the argument git_diff.base_ref/git_diff.files results in os command injection.

This vulnerability is identified as CVE-2026-5125. The attack is only possible with local access. Additionally, an exploit exists.

Upgrading the affected component is recommended.