Vulnerabilities

GitHub MCP Server versions prior to 1.1.0 contain a nil pointer dereference (CWE-476) in the CompletionsHandler function in pkg/github/server.go, which accesses the ref field of a completion request without first verifying it is present. Any unauthenticated client able to send JSON-RPC messages to the server can trigger the flaw by issuing a completion/complete request with a missing or empty ref field. Because the dereference happens before any authentication or token validation, the resulting Go runtime panic crashes the server and yields a complete denial of service. All deployments running an affected version are potentially affected, with the greatest risk for instances reachable over a network by unauthenticated clients, while locally run stdio instances are only reachable by their local client. No widespread exploitation is reported (0.4% EPSS, not in CISA KEV), but a public security advisory documents the issue and the triggering request is trivial to craft.

Do: Upgrade to GitHub MCP Server 1.1.0 or later, which adds the missing nil check in CompletionsHandler. Until patched, restrict any HTTP/SSE-exposed instance with authentication or network allowlisting, since the crashing request requires no credentials. Audit deployments to determine which are network-reachable versus local-only, and watch for unauthenticated completion/complete requests that crash the process.