An unauthenticated remote command injection vulnerability in the dvladimirov MCP Git Search API poses a critical risk of full system compromise.

The application fails to sanitize the pattern input parameter before passing it into a shell command within the mcp/git_service.py file. This allows an unauthenticated attacker to inject shell metacharacters and execute arbitrary commands on the host operating system with the privileges of the service.

Successful exploitation allows an attacker to execute arbitrary code on the underlying host, leading to a complete loss of confidentiality, integrity, and availability. While the CVSS score is 7.3, the potential for remote code execution and the availability of a public proof-of-concept elevate the urgency for immediate remediation. Unauthorized access to the host could result in the exfiltration of sensitive repository data or the pivot of the attacker into internal network segments.

Immediate Action: As no official patch is currently available, restrict access to the affected Git search HTTP endpoint to trusted internal networks only. If possible, disable the Git search functionality entirely until the vendor releases a secure update.

Proactive Monitoring: Review web server and application logs for suspicious POST requests to the /v1/models/git-analyzer/search endpoint containing shell metacharacters such as semicolons, pipes, or command substitution syntax. Monitor system process logs for unexpected child processes spawned by the MCP service.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming JSON payloads that contain shell injection sequences in the pattern field. Implement strict network segmentation to limit the blast radius if the service is compromised.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue report referenced by the CVE record.

This vulnerability represents a significant security flaw that requires immediate attention. Organizations utilizing the dvladimirov MCP software should prioritize restricting network access to the vulnerable endpoint and monitor for signs of unauthorized activity. Once a security patch is provided by the vendor, it should be applied without delay to eliminate the underlying command injection flaw.