The MCP Tool contains a command injection flaw in the git_operation function of server.py. By manipulating the "operation" argument that is passed to the function, an attacker who can reach the exposed endpoint can cause the underlying shell to execute arbitrary commands. The defect is classified as CWE‑74 and CWE‑77 because user control data is incorporated into a shell command without adequate validation or sanitisation.

All releases of 54yyyu code‑mcp that include the git_operation code up to the commit 4cfc4643541a110c906d93635b391bf7e357f4a8 are vulnerable. No later commit has been confirmed to contain a fix, and the project maintainer has yet to respond to the issue report. Continuous delivery with rolling releases is used, so vulnerability status will not change until a patch is released.

The CVSS score of 6.9 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalogue. Attacks can be launched remotely through the git_operation endpoint, and the exploit has already been published publicly. Because no patch is available, the risk remains significant until the maintainer addresses the issue. Network exposure of the service increases the likelihood that an attacker will discover a usable target.