PT-2026-35150 · Divyanshu Hash · Gitpilot-Mcp

Bigw · Published 2026-04-25 · Updated 2026-04-25 · CVE-2026-6980

Mitre

CVSS v3.1

7.3

High

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A vulnerability has been found in Divyanshu-hash GitPilot-MCP up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd. This impacts the function repo path of the file main.py. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-6980

Affected Products

Gitpilot-Mcp

References · 5

• 🔥 https://github.com/wing3e/public_exp/issues/38 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6980 · Security Note
• https://vuldb.com/vuln/359523/cti · Note
• https://vuldb.com/vuln/359523 · Note
• https://vuldb.com/submit/795502 · Note