CVE-2026-6980 Details
Description
A vulnerability has been found in Divyanshu-hash GitPilot-MCP up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd. This impacts the function repo_path of the file main.py. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
A command injection vulnerability has been identified in Divyanshu-hash GitPilot-MCP versions up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd. The issue arises in the 'repo_path' function of 'main.py', where the 'command' argument is not properly validated before being executed with 'shell=True'. This flaw allows remote attackers to inject and execute arbitrary shell commands. The vulnerability has been publicly disclosed and is exploitable.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 25, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wing3e/public_exp/issues/38 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/submit/795502 | [email protected] | Technical Description |
| https://vuldb.com/vuln/359523 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/359523/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Divyanshu-hash GitPilot-MCP | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 25, 2026 | New CVE Received | [email protected] |