This vulnerability involves command injection in the GitSearchRequest function of the dvladimirov MCP Git Search API component (mcp_server.py). By manipulating the repo_url or pattern argument, an unauthenticated remote attacker can execute arbitrary commands on the affected system. The affected version is 0.1.0. The vulnerability was responsibly disclosed but remains unpatched as of the publication date. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality, integrity, and availability impacts. No official remediation or patch is currently available from the vendor.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected system, potentially compromising confidentiality, integrity, and availability to a limited extent. The medium CVSS score reflects that the attack is remotely executable without privileges or user interaction but with limited impact severity. No known active exploitation has been reported, but public exploit code exists, increasing the risk of future attacks.

No official patch or remediation is currently available from the vendor, and the project has not responded to the vulnerability report. Users should consider implementing network-level protections such as restricting access to the affected service to trusted hosts only. Monitor for unusual activity related to the Git Search API component. Stay alert for any future vendor advisories or patches addressing this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.