This vulnerability affects crazyrabbitLTC's mcp-code-review-server up to version 0.1.0. It involves command injection in the executeRepomix function of the RepoMix Command Handler component. An attacker can remotely manipulate inputs to execute arbitrary system commands. The vulnerability was responsibly disclosed via a pull request, but no remediation or patch has been released by the vendor. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected system, potentially leading to unauthorized system control or data compromise. The impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No known exploits in the wild have been reported yet, but public exploit code exists.

No official fix or patch is currently available from the vendor. Since the project has not reacted to the disclosure, users should consider applying manual mitigations such as restricting network access to the vulnerable service and monitoring for suspicious command execution. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.