An unauthenticated remote command injection vulnerability in 54yyyu code-mcp allows attackers to achieve partial system access via the git_operation function.

This is a command injection flaw occurring in the git_operation function within src/code_mcp/server.py due to unsafe string formatting and subprocess execution with shell=True, requiring no authentication.

A successful exploit permits malicious actors to execute arbitrary operating system commands, threatening the confidentiality, integrity, and availability of the host system and stored data. Although the CVSS score is 7.3, the presence of a public proof-of-concept and remote attack vector elevate the operational risk for deployed instances.

Immediate Action: Restrict network access to the MCP server and disable the vulnerable git_operation tool until a vendor patch is released.

Proactive Monitoring: Monitor system logs for anomalous child processes spawned by the python interpreter and unexpected command line arguments.

Compensating Controls: Deploy a Web Application Firewall or network access control list to limit inbound connections to trusted management sources only.

Public Exploit Available: Yes, a public proof-of-concept exists via the GitHub issue reference.

Given the availability of a public proof-of-concept and the severity of command injection, administrators must treat this flaw with high urgency. Because a formal vendor patch is currently unavailable, organizations should apply compensating network restrictions and isolate the service to prevent potential compromise.