Description
A vulnerability has been found in DeDeveloper23 codebase-mcp up to 3ec749d237dd8eabbeef48657cf917275792fde6. This vulnerability affects the function getCodebase/getRemoteCodebase/saveCodebase of the file src/tools/codebase.ts of the component RepoMix Command Handler. Such manipulation leads to os command injection. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-03-29
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local OS Command Injection
Action: Apply Patch
AI Analysis

Impact

The flaw resides in the RepoMix Command Handler's getCodebase, getRemoteCodebase, and saveCodebase functions, allowing improper validation of user input to construct operating system commands. This leads to OS command injection, which can enable a local attacker to execute arbitrary commands and potentially gain full control of the affected system. The weakness corresponds to CWE-77 and CWE-78.

Affected Systems

The vulnerability affects the DeDeveloper23 codebase-mcp package. Versions up to commit 3ec749d237dd8eabbeef48657cf917275792fde6 are impacted. The project uses a rolling release model, so precise affected releases are not listed, but any version before the fix will be vulnerable.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the RepoMix Command Handler; an attacker with such access can trigger the injection. While the attack vector is local, the impact of successful exploitation can be significant, turning a locally authenticated user into a system compromise.

Generated by OpenCVE AI on March 29, 2026 at 05:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest codebase-mcp release that contains the fix (commit after 3ec749d237dd8eabbeef48657cf917275792fde6).
  • If an immediate update is not possible, restrict access to the command handler to trusted users only.
  • Monitor logs for abnormal command execution patterns.
  • Contact the maintainers for a patch if not yet released.

Generated by OpenCVE AI on March 29, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 30 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 30 Mar 2026 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Dedeveloper23
Dedeveloper23 codebase-mcp
Vendors & Products Dedeveloper23
Dedeveloper23 codebase-mcp

Sun, 29 Mar 2026 02:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in DeDeveloper23 codebase-mcp up to 3ec749d237dd8eabbeef48657cf917275792fde6. This vulnerability affects the function getCodebase/getRemoteCodebase/saveCodebase of the file src/tools/codebase.ts of the component RepoMix Command Handler. Such manipulation leads to os command injection. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Title DeDeveloper23 codebase-mcp RepoMix codebase.ts saveCodebase os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Dedeveloper23 Codebase-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-30T14:52:49.798Z

Reserved: 2026-03-27T14:24:26.539Z

Link: CVE-2026-5023

cve-icon Vulnrichment

Updated: 2026-03-30T13:14:17.020Z

cve-icon NVD

Status : Deferred

Published: 2026-03-29T02:16:17.640

Modified: 2026-04-24T16:36:24.067

Link: CVE-2026-5023

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-30T06:58:41Z

Weaknesses