Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/github/github-mcp-server

2 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
v1.14.0 (Oct 2, 2026): no advisory affects it
Newest unaffected release
v1.14.0 (Oct 2, 2026), the latest release
Advisories
2 · 1 high, 1 medium
Releases
84 since v0.1.0 (Apr 4, 2025)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler

    Affected: fixed in 1.1.0.

    Fixed in v1.1.0 (released May 28, 2026, 61 days before disclosure).

    The latest release, v1.14.0, is not affected.

  • CVE-2026-48529Medium 6.0

    GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

    Affected: from 0.22.0, fixed in 1.1.2.

    Fixed in v1.1.2 (released May 29, 2026, 28 days before disclosure).

    The latest release, v1.14.0, is not affected.