Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/github/github-mcp-server | go | < 1.1.0 | 1.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-w4q6-qw23-4rg7, is a nil pointer dereference in the GitHub MCP Server. The provided description and stack trace explicitly point to the CompletionsHandler function in pkg/github/server.go. Analysis of the fixing commit c88d2ecdd3bb07f7bdd75296e3ee676febf14f58 confirms this. The patch introduces a nil check for the req, req.Params, and req.Params.Ref variables within the anonymous function returned by CompletionsHandler. The lack of this check in vulnerable versions allowed a specially crafted JSON-RPC message to cause the server to panic and crash. The vulnerable function is identified as CompletionsHandler.func1, which is how Go's runtime profiler would represent the anonymous function where the crash occurs.
CompletionsHandler.func1pkg/github/server.go