An OS command injection vulnerability in Branch Monkey MCP allows unauthenticated remote attackers to achieve arbitrary command execution via the preview endpoint.

This is an OS Command Injection (CWE-78) vulnerability located in the branch_monkey_mcp/bridge_and_local_actions/routes/advanced.py file. The vulnerability occurs because the dev_script request parameter is passed directly to the system shell using subprocess.Popen with shell=True without proper validation or sanitization, requiring no authentication by an attacker.

A successful exploit of this vulnerability grants an attacker full command execution capabilities on the underlying host operating system. This can lead to total confidentiality, integrity, and availability compromise, resulting in unauthorized access to sensitive local files, system modification, or complete service disruption. Although the CVSS score is listed as 7.3, the potential for remote code execution and the availability of a public proof-of-concept demand a high-urgency remediation approach.

Immediate Action: Since an official patch is not yet available from the vendor, restrict network access to the preview endpoint immediately and isolate the affected service.

Proactive Monitoring: Review web server and system access logs for anomalous requests targeting /api/local-claude/time-machine/preview, and monitor process creation logs for unexpected shell execution spawned by Python.

Compensating Controls: Deploy a Web Application Firewall rule or reverse proxy filter to inspect incoming JSON payloads on the preview endpoint, specifically blocking shell metacharacters such as semicolons, ampersands, backticks, and dollar signs within the dev_script parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the GitHub issue report.

Given the critical nature of remote code execution flaws, administrators should isolate vulnerable instances of Branch Monkey MCP immediately. Organizations must monitor for vendor updates and restrict network exposure until a permanent fix eliminating raw shell execution is released.