Description

A weakness has been identified in andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolearn/GitHooksManager.ts of the component llm_memory_mcp. Executing a manipulation of the argument hash can lead to command injection. The attack is restricted to local execution. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-08T13:17:10.603Z",
  "pubdate": "2026-08-08T13:17:10.603Z",
  "executiveSummary": "A command injection vulnerability has been identified in the andreahaku llm_memory_mcp component up to commit f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. The flaw resides in the auto.capture function within src/autolearn/GitHooksManager.ts. Improper input validation and sanitization of the hash argument allow an attacker to execute arbitrary system commands in the context of the running process. Because the product lacks formal versioning, all installations utilizing the affected codebase up to the specified commit are considered vulnerable. The attack vector is restricted to local execution, requiring the adversary to manipulate the hash parameter passed to the vulnerable function. Successful exploitation results in local command execution, potentially leading to unauthorized system access, data compromise, or further local privilege escalation depending on the privileges of the executing process. The project developers were notified via an issue report but have not yet provided a response or official patch.",
  "technicalDetails": "The vulnerability stems from insecure handling of input parameters within the auto.capture function located in the src/autolearn/GitHooksManager.ts file of the llm_memory_mcp component. Specifically, the hash argument is processed and passed to underlying operating system shell execution sinks without adequate sanitization, validation, or structural parameterization.\nRoot Cause: The root cause of the vulnerability is the direct concatenation or unsafe interpolation of untrusted input data (the hash argument) into a system shell command string. When the application invokes system execution utilities via the vulnerable GitHooksManager.ts module, the lack of input escaping allows an attacker to inject shell metacharacters such as semicolons, pipes, or backticks.\nExploitation Method and Attack Flow: An attacker exploits this vulnerability by supplying a maliciously crafted payload within the hash argument. The step-by-step attack flow begins when the auto.capture function receives the manipulated input. Lacking proper validation filters, the function appends or incorporates the malicious string directly into a system command execution context. As the operating system shell parses the constructed command string, it evaluates the injected metacharacters and executes the attacker's arbitrary payload alongside or instead of the intended operation.\nComponent and Version Scope: The vulnerable component is llm_memory_mcp, specifically targeting the function auto.capture in src/autolearn/GitHooksManager.ts. The issue affects all versions and commit states up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. The product does not utilize semantic versioning, meaning affected releases cannot be delineated by version numbers.\nAuthentication, Privileges, and Exposure: The exploitation of this vulnerability is restricted to local execution, meaning an attacker must already possess local access to the system or a mechanism to supply controlled input to the vulnerable function. No network exposure is explicitly required for this specific vector. Depending on how the llm_memory_mcp component is integrated and invoked, local users or interacting processes can trigger the flaw.\nPost-Exploitation Impact: Successful command injection leads to the execution of arbitrary commands with the privileges of the process running the llm_memory_mcp component. This can result in unauthorized reading or modification of sensitive data, execution of malicious binaries, and potential persistence on the host system."
}