PT-2026-35150 · Unknown · Gitpilot-Mcp

Bigw · Published 2026-04-25 · Updated 2026-04-25 · CVE-2026-6980

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Divyanshu-hash GitPilot-MCP versions up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd

Description Remote command injection is possible through the manipulation of the command argument. This issue impacts the repo path() function within the main.py file, allowing an attacker to execute arbitrary commands remotely.

Recommendations As a temporary workaround, consider restricting the use of the repo path() function until a fix is available.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-6980

Affected Products

Gitpilot-Mcp

References · 7

• 🔥 https://github.com/wing3e/public_exp/issues/38 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6980 · Security Note
• https://vuldb.com/vuln/359523/cti · Note
• https://vuldb.com/vuln/359523 · Note
• https://vuldb.com/submit/795502 · Note
• https://twitter.com/CVEnew/status/2048099266556563825 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2048048851177635866 · Twitter Post