The vulnerability resides in MCP's Git Search API, specifically the GitSearchRequest function in mcp_server.py. Malicious input injected into the repo_url or pattern arguments is passed unsanitized to a shell, resulting in arbitrary command execution on the host – a CWE‑74 Command Injection flaw that also reflects a CWE‑77 Improper Restriction of Operations within a Component. This can allow an attacker to read, modify, delete data, install malware, and compromise confidentiality, integrity, and availability of the affected system.

MCP by dvladimirov, versions up to 0.1.0. No further subversions are listed.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is 1%, indicating a low but non‑zero exploitation probability. The vulnerability is not listed in KEV, but public exploits are available and the attack vector is remote via the exposed API. The absence of filtering on repo_url/pattern makes exploitation highly likely. Administrators should consider it a high‑risk issue pending a patch.