A remote attacker can exploit unsanitized user input in the Git Integration component of Intina47 context-sync to inject arbitrary operating‑system commands. The flaw resides in src/git‑integration.ts and is classified as CWE‑77 and CWE‑78. Successful exploitation would allow the attacker to execute arbitrary commands on the host running the application, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability impacts all versions of Intina47 context-sync up to 2.0.0.

Affected systems include all deployments of Intina47 context-sync with versions 1.x through 2.0.0, regardless of environment, as the vulnerable code path is present in the component named Git Integration. The component is available in the open‑source repository and may be used in web applications, CI/CD pipelines, or services that interact with Git repositories. Any installation that relies on the unpatched source code is vulnerable.

The CVSS base score of 6.9 indicates a medium to high severity. The EPSS score is less than 1%, suggesting a low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Because the attack can be performed remotely through manipulated input, the risk is elevated for exposed interfaces. However, exploitation requires that the vulnerable Git Integration module is in use and that the application runs with sufficient privileges to execute system commands. Mitigations such as disabling shell execution or updating to a patched release lower the risk substantially.