This vulnerability in Intina47 context-sync up to version 2.0.0 involves OS command injection in the Git Integration component, specifically in the src/git-integration.ts file. An attacker can remotely execute arbitrary operating system commands by manipulating input to this component. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. The vulnerability has been publicly disclosed but no official fix or patch is currently documented.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system, potentially leading to unauthorized system control or data compromise. The impact is rated medium based on the CVSS score and vector, reflecting limited but significant risk due to remote exploitability without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the vulnerable component and monitor for suspicious activity related to command execution. Avoid exposing the affected service to untrusted networks if possible.