The vulnerability occurs in the cloneRepository function within src/index.ts of the add_git_repository/add_text_file component of the mcp-docs-rag project. An attacker can supply specially crafted input that is passed unsanitized to an operating‑system command, allowing them to execute arbitrary commands. Because the flaw resides in a local function, the attack requires local access to the system running the application, but the exploit code is publicly available and has already been demonstrated. Successful exploitation would give the attacker full read/write access to the file system and the ability to run any command as the user under which the application is running.

The issue affects all releases of kazuph mcp-docs-rag up to and including version 0.5.0. The product is distributed under the name mcp-docs-rag by vendor kazuph. No specific patch versions were listed, so any deployment of the vulnerable code base prior to an unnoted fix must be considered affected.

The CVSS score of 4.8 indicates a moderate severity, and the EPSS score is unavailable. The vulnerability is not listed in CISA's KEV catalog. Since the attack vector is local, an adversary must already have some form of access to the host, but once present the exploitation is straightforward thanks to the publicly available payload. Therefore, organizations should consider mitigation early, especially if the system is exposed to untrusted local users.