The vulnerability lies in the child_process.execSync call within src/server.ts where unvalidated git_diff.base_ref and git_diff.files values are passed to an operating system shell. This flaw permits OS command injection, which can lead to execution of arbitrary commands on the host system. The weakness is a classic command injection issue classified under CWE-77 and CWE-78. The impact is limited to local actors who can interact with the server, allowing them to run potentially destructive commands and compromise local confidentiality, integrity, or availability. The affected function is exposed in raine consult-llm-mcp up to version 2.5.3.

The issue affects the raine consult-llm-mcp product, specifically any deployment running a version prior to 2.5.4. Upgrading to release 2.5.4 or later incorporates the fix identified by commit 4abf297b34e5e8a9cb364b35f52c5f0ca1d599d3. Users running older releases should identify whether their systems include the vulnerable server.ts implementation and then apply the upgrade.

With a CVSS score of 4.8 the vulnerability is considered moderate; it requires local access, and the exploit is publicly available. Although the EPSS score and KEV status are not listed, the public nature of the exploit and the fact that it can be triggered with any local user privilege level elevate the risk for environments where the application runs with elevated permissions. Mitigation through patching remains the most effective countermeasure.