This vulnerability involves command injection (CWE-78) in automagik-genie 2.5.27 MCP Server. Specifically, the issue arises in the readTranscriptFromCommit function's handling of the view_task parameter when interacting with an external FORGE_BASE_URL, allowing remote attackers to execute arbitrary commands on the server. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected server, allowing attackers to execute arbitrary commands remotely without authentication or user interaction. This can result in complete loss of confidentiality, integrity, and availability of the system. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — no official fix or vendor advisory is available at this time. Users should monitor the vendor's communications for updates and apply any official patches once released. Until then, restrict access to the affected functionality and avoid using external FORGE_BASE_URL inputs if possible to reduce exposure.