PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-116369 Sunwood-ai-labs CVE debrief

A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue.

Vendor
Sunwood-ai-labs
Product
github-kanban-mcp-server
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-26
Original CVE updated
2026-10-31
Advisory published
2026-10-26
Advisory updated
2026-10-31

Who should care

Defenders responsible for Sunwood-ai-labs github-kanban-mcp-server systems should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify patch presence, upgrade to version 0.4.1 if necessary, and review system logs for potential exploitation attempts.

Why it matters

CVE-2026-116369 is a medium-severity vulnerability in Sunwood-ai-labs github-kanban-mcp-server that allows remote OS command injection. Defenders should prioritize verifying patch presence and upgrading to version 0.4.1 if necessary.

  • Verify patch presence and upgrade to version 0.4.1 if necessary.
  • Assess exposure of affected component.
  • Review system logs for potential exploitation attempts.

Technical summary

The handleListIssues function in issue-handlers.ts is vulnerable to OS command injection due to improper handling of the state/labels argument. This can be exploited remotely. The vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Upgrading to version 0.4.1 is recommended to address this issue. The patch 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae should be applied. Defenders should prioritize verifying patch presence and upgrading to version 0.4.1 if necessary. The CVE record and source item provide details about the vulnerability, including its description, affected versions, and recommended patch.

Defensive priority

Defenders should prioritize verifying the presence of the patch (253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae) in their systems and upgrading to version 0.4.1 if necessary.

Recommended defensive actions

  • Verify the presence of the patch (253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae) in your systems.
  • Upgrade to version 0.4.1 if necessary.
  • Review the affected component and assess exposure.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and recommended patch. However, there is limited information about potential exploitation or victim impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-116369 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-116369

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-116369 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-116369

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Sunwood-ai-labs github-kanban-mcp-server issue-handlers.ts handleListIssues os command injection

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116369.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/426333

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/426333/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-116369

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/1013075

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/issues/26

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/pull/27

    Supplemental source - issue-tracking, patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/commit/253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae

    Supplemental source - patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.