This vulnerability exists in the DeDeveloper23 codebase-mcp up to commit 3ec749d237dd8eabbeef48657cf917275792fde6. It affects the functions getCodebase, getRemoteCodebase, and saveCodebase in src/tools/codebase.ts within the RepoMix Command Handler component. The flaw allows local attackers to perform OS command injection by manipulating inputs to these functions. The product's rolling release model complicates version tracking, and no official patch or vendor response has been published. The vulnerability was publicly disclosed and may be exploited, but no known exploits in the wild have been reported.

Successful exploitation allows a local attacker to execute arbitrary OS commands on the affected system with the privileges of the application. This could lead to unauthorized command execution and potential system compromise depending on the privileges of the process running the vulnerable code. The impact is limited by the requirement for local access and the low complexity of attack, with no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should restrict local access to trusted users only and monitor for suspicious activity related to the affected functions. Avoid running the vulnerable version in untrusted environments until a patch or official mitigation is available.