This vulnerability affects Divyanshu-hash GitPilot-MCP up to commit 9ed9f153ba4158a2ad230ee4871b25130da29ffd. The issue lies in the repo_path function within main.py, where improper handling of the command argument leads to command injection. This allows an unauthenticated remote attacker to execute arbitrary commands on the affected system. The vulnerability is tracked as CVE-2026-6980 and is associated with CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-74 (Injection). The vendor has not provided any patch or response, and the product lacks versioning, complicating identification of unaffected versions.

Successful exploitation can lead to remote command execution with no privileges required and no user interaction needed. The impact includes potential compromise of the affected system, data exposure, or further system manipulation. The CVSS score of 6.9 reflects a medium severity with low complexity and no privileges required for exploitation. Although exploit code is publicly available, there are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying manual code review and mitigation such as input validation or disabling the vulnerable functionality if feasible. Monitor for updates from the vendor or trusted security sources for any forthcoming patches or official mitigations.