This vulnerability in Divyanshu-hash GitPilot-MCP up to commit 9ed9f153ba4158a2ad230ee4871b25130da29ffd affects the repo_path function in main.py, where improper handling of the command argument leads to command injection. The attack can be performed remotely without authentication or user interaction. The vendor has not provided any response or patch, and the product lacks versioning, complicating identification of affected releases. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. Public disclosure of the exploit exists, but no active exploitation has been confirmed.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected system, potentially compromising system integrity and confidentiality. Given the medium CVSS score and the lack of privileges or user interaction required, this vulnerability poses a moderate risk. However, no known active exploitation has been reported to date.

No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Users should monitor vendor channels for any future updates. Until a fix is provided, consider restricting network access to the affected service and applying additional controls to limit command injection risks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.