CVE-2026-106764 rog0x CVE debrief

Who should care

Defenders of npm projects using @rog0x/mcp-git-tools version 1.0.1 should assess exposure and verify if the package is used in their projects. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the vulnerability and its potential impact on their systems. They should also check for updates or patches and plan for remediation if necessary.

Why it matters

CVE-2026-106764 allows remote attackers to execute arbitrary code via the resolveBaseBranch function in @rog0x/mcp-git-tools 1.0.1. Defenders of npm projects using this package should assess exposure, verify usage, and check for updates or patches.

• Potential arbitrary code execution
• Possible remote attacker exploitation
• Required verification of affected scope and remediation

Technical summary

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. The vulnerability is in the npm package @rog0x/mcp-git-tools, which is used in various projects. Defenders should assess exposure, verify usage, and check for updates or patches. The technical details of the vulnerability are limited, but it is known to be exploitable by remote attackers. Further verification is required to determine the actual impact and affected scope. This summary provides affected product context, defensive impact, and source-grounded technical framing.

Defensive priority

Assess exposure of npm projects using @rog0x/mcp-git-tools version 1.0.1

Recommended defensive actions

• Assess exposure of npm projects using @rog0x/mcp-git-tools version 1.0.1
• Verify if @rog0x/mcp-git-tools is used in your npm projects
• Check for updates or patches for @rog0x/mcp-git-tools
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the actual impact and affected scope. Defenders should verify if @rog0x/mcp-git-tools is used in their npm projects, assess exposure, and check for updates or patches. The source item from osv_dev provides vulnerability details, but additional information is needed to fully understand the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.