A critical OS command injection vulnerability in GitPilot-MCP allows unauthenticated remote attackers to execute arbitrary commands on the underlying host system.

The application utilizes the subprocess.run function with shell=True to execute the command argument in the run_tests tool without validation, enabling unauthenticated command injection.

A successful exploit grants the attacker full control over the host environment where the GitPilot-MCP service is running. This leads to complete loss of confidentiality, integrity, and availability, as attackers can read sensitive files, modify source code repositories, or disrupt critical CI/CD workflows. While the CVSS score is 7.3, the potential for arbitrary code execution and the presence of public exploit material warrant immediate attention.

Immediate Action: As no official patch is currently available, administrators should disable the affected tool or restrict network access to the MCP interface using strict firewall rules or mTLS authentication.

Proactive Monitoring: Review application logs for suspicious entries in the command argument of the run_tests tool, specifically looking for shell metacharacters such as semicolons, pipes, or backticks.

Compensating Controls: Deploy a Web Application Firewall or an API gateway to intercept and block incoming MCP JSON-RPC requests containing suspicious command strings or unexpected shell syntax.

Public Exploit Available: Yes, a published proof-of-concept exists in the referenced security report (https://github.com/wing3e/public_exp/issues/38).

Given the ease of exploitation and the severity of command injection, organizations currently utilizing GitPilot-MCP must prioritize the implementation of compensating controls. Since the vendor has not provided a security update, disabling the vulnerable functionality is the only reliable way to eliminate the risk of remote code execution until a secure version is released.