Repository advisory GHSA-7v25-vcp6-4hcr not in global Advisory Database

Open

#9,721 opened on Sep 23, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 30/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Active
Tech stack: git, python
Domain: security

Research direction

This is a request for the GitHub Advisory Database curation team to review a published repository advisory for inclusion. The issue is about process and database synchronization, not code changes. A newcomer would need to understand the advisory database ingestion pipeline, the criteria for inclusion, and how to escalate a stuck advisory. Check the repository's contribution guidelines and existing similar issues to see how curation requests are handled. 'Done' means the advisory appears in the global database.

Written by the indexing model from the issue text.

Description

Summary

I maintain tumf/mcp-shell-server. Repository advisory GHSA-7v25-vcp6-4hcr was published on 2026-09-19 and remains absent from the global GitHub Advisory Database more than 72 hours later.

Advisory

Repository advisory: https://github.com/tumf/mcp-shell-server/security/advisories/GHSA-7v25-vcp6-4hcr
Package: mcp-shell-server (pip)
Affected versions: <= 1.1.11
Patched version: 1.1.12
CWE: CWE-88
Severity: High
Reporter credit: accepted

The advisory describes Git global options with separated values causing the validator to misidentify the subcommand, allowing persistent git config writes and later command execution when git is allowlisted. Version 1.1.12 fixes the affected parser state.

Current state

Repository advisory state: published
cve_id: null
submission.accepted: false
GET /advisories/GHSA-7v25-vcp6-4hcr: 404 Not Found
Advisory updated_at: 2026-09-19T01:21:39Z

Request

Could the curation team review this published repository advisory for inclusion in the global GitHub Advisory Database?

I have not requested a CVE because database inclusion and CVE assignment are separate. If a CVE or additional information is required for curation, please advise.

Dominant language: No language data
Stars: 2.5k
Forks: 772
Avg merge: 3d 15h
Merged PRs (30d): 46

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

OpenVEX statements carry no subcomponent package or version Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

NVIDIA/aicr#2945 · Opened Sep 23, 2026
Signed left-shift undefined behavior in `nbase/nbase_addrset.c` (`(1<<31)`, 4 sites) Open

Nmap

Difficulty 1/5 Under an hour Newbie friendliness 85/100

nmap/nmap#3514 · Opened Sep 23, 2026
CVE-2026-93748 (High) detected in http-cache-semantics-4.1.1.tgz Open

Mend: dependency security vulnerability untriaged

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

opensearch-project/OpenSearch-Dashboards#12806 · Opened Sep 23, 2026
False positive: TurkScan.com / TurkChain network Open

blocklist removal

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

MetaMask/eth-phishing-detect#296544 · Opened Sep 23, 2026
Usage of curl in mcr.microsoft.com/azure-functions/dotnet-isolated:4-dotnet-isolated10.0 Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

Azure/azure-functions-docker#1257 · Opened Sep 23, 2026

More Security issues