This vulnerability exists in crazyrabbitLTC mcp-code-review-server up to version 0.1.0, specifically in the executeRepomix function of the src/repomix.ts file. It allows remote command injection through manipulated input to the RepoMix Command Handler component. The vulnerability was responsibly disclosed via a pull request but remains unpatched. The exploit is publicly known, increasing the risk of exploitation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system remotely. This could lead to unauthorized actions depending on the privileges of the affected service. The medium severity score reflects the potential for moderate impact. There are no known exploits in the wild at this time, but the exploit code is publicly available, which may increase the likelihood of future attacks.

No official patch or remediation is currently available, and the vendor has not reacted to the reported issue. Users should monitor the project repository and vendor advisories for updates. Until a fix is released, consider restricting network access to the affected service and applying compensating controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.