All vulnerabilities

CVE-2026-NONE · GHSA-m9x7-h9px-p447

mcp-server-circleci: unauthenticated command injection in run_evaluation_tests leads to RCE in the CircleCI runner

criticalCVSS 10.0CWE-78

Vendor

CircleCI-Public

Package

mcp-server-circleci npm

Affected

< 0.16.1

Fixed in

0.16.1

Disclosed

2026-07-22

Credit

Avishai Gonen

command-injectionrcemcp

Published advisory