The vulnerability in geldata gel-mcp 0.1.0 arises from improper validation of the rule_name parameter in the list_rules/fetch_rule function within src/gel_mcp/server.py. This allows an unauthenticated remote attacker to perform path traversal attacks, potentially accessing files outside the intended directory. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality with no impact on integrity or availability. Although an exploit is publicly available, the vendor has not yet provided a remediation or official response.

An attacker can remotely exploit this vulnerability to traverse directories and access files outside the intended scope of the application. The impact on confidentiality is low, with no direct impact on integrity or availability according to the CVSS vector. Since the exploit is public, there is an increased risk of exploitation, but no known exploits in the wild have been reported. The lack of vendor response or patch means the vulnerability remains unmitigated.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is released, consider implementing network-level controls to restrict access to the vulnerable service or applying application-layer filters to validate and sanitize input parameters such as rule_name. Avoid exposing the affected service directly to untrusted networks.