CVE-2026-102911: pi-llm-wiki's wiki_capture_source MCP Tool Put a URL Inside `sh -c` (CVSS 9.9); github-mcp-server git_remove Is Unpatched

NVD published two OS command injection CVEs in MCP servers on 30 September 2026, both assigned by VulDB from public issue reports with PoCs. CVE-2026-102911 (CVSS 3.1 9.9, CVSS 4.0 8.6) affects zosmaai pi-llm-wiki up to 0.11.7, a knowledge-base extension for the Pi coding agent: its wiki_capture_source MCP tool interpolated the `url` argument into a `sh -c` command running markitdown, so a crafted URL, which an agent can be talked into passing from untrusted content, ran shell commands as the developer. The maintainer fixed it within about a day of the 31 August report, in 0.11.8 (1 September), by passing argv directly, but the fix appeared as a single changelog line with no advisory. CVE-2026-102906 (CVSS 3.1 6.3) affects 0xshariq github-mcp-server up to commit 52e764a: its git_remove tool builds `git reset HEAD "${file}"` and hands it to child_process.exec without the sanitiser some other tools in the same file call. The project uses rolling releases, the report has been open since 31 August without a maintainer response, and there is no fix. Both GitHub advisories (GHSA-jcgm-7m3g-h3cx, GHSA-7v7v-c4gg-gf73) are unreviewed with no package mapping, so npm audit and OSV return nothing for the affected versions. Not to be confused with GitHub's official github-mcp-server.

You are affected if you run @zosmaai/pi-llm-wiki <0.11.8. Versions 0.11.8 and later include the fix.

Upgrade pi-llm-wiki to 0.11.8 or later and check the version actually pinned in Pi's extension config rather than the changelog. Remove 0xshariq/github-mcp-server or at least disable its git_remove tool: there is no patch and the maintainer has not responded; confirm you are not confusing it with GitHub's official github-mcp-server before acting. Inventory MCP servers from agent host configs and extension directories rather than package manifests, since these advisories carry no package mapping and SCA tools report them clean. Require approval for MCP tools that take URLs or file names and touch a shell, and treat any MCP tool argument as attacker-influenced when the agent has read untrusted content.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run @zosmaai/pi-llm-wiki and which version, then enforce a policy on it.