What is CVE-2026-47427?

CVE-2026-47427 is a high-severity vulnerability in Github Github-mcp-server, classified under NULL Pointer Dereference. CVSS score: 7.5/10. Published 2026-07-28.

How severe is CVE-2026-47427?

High severity. CVSS v3 base score is 7.5 out of 10.

NULL pointer dereference in Github Github-mcp-server

CVE-2026-47427

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or emp…

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Github Github-mcp-server — versions < 1.1.0

Weakness classification (CWE)

CWE-476 — NULL Pointer Dereference

References

security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-47427?: CVE-2026-47427 is a high-severity vulnerability in Github Github-mcp-server, classified under NULL Pointer Dereference. CVSS score: 7.5/10. Published 2026-07-28.
How severe is CVE-2026-47427?: High severity. CVSS v3 base score is 7.5 out of 10.