This vulnerability in Intina47 context-sync up to version 2.0.0 involves OS command injection in the Git Integration component, specifically in the src/git-integration.ts file. The flaw allows remote attackers to manipulate inputs leading to execution of arbitrary operating system commands. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability. The vulnerability has been publicly disclosed but lacks an official fix or patch at this time.

Successful exploitation could allow remote attackers to execute arbitrary OS commands on affected systems, potentially leading to unauthorized control or disruption of the context-sync application. The impact is rated medium due to limited confidentiality, integrity, and availability impacts and the absence of known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the vulnerable component and monitor for unusual activity related to the Git Integration functionality. Avoid exposing the affected service to untrusted networks where possible.