This vulnerability exists in the MCP Tool component of 54yyyu code-mcp, where the git_operation function improperly handles the operation argument, allowing an attacker to perform command injection remotely. The vulnerability is present in the code up to the specified commit. Due to the continuous delivery model, no explicit version numbers are available for affected or fixed releases. The vendor has not issued any official fix or advisory. The CVSS 4.0 score is 6.9 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, but with low to limited confidentiality, integrity, and availability impacts. Public exploit details exist, but no active exploitation is confirmed.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected system via manipulation of the operation argument in the git_operation function. This can lead to unauthorized command execution, potentially compromising system integrity and availability. However, the impact is rated medium due to limited scope of confidentiality, integrity, and availability impacts as per CVSS 4.0 metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has not responded or released a fix at this time. Users should monitor official channels for updates and consider implementing temporary mitigations such as input validation or restricting access to the vulnerable function if feasible.