high2026-10-23 CVE-2026-106764-@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function GHSA-jwc4-922r-f2rw