CVE-2026-6980
Published: 25 April 2026
Summary
CVE-2026-6980 is a medium-severity Injection (CWE-74) vulnerability. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A command injection vulnerability exists in Divyanshu-hash GitPilot-MCP up to commit 9ed9f153ba4158a2ad230ee4871b25130da29ffd, specifically in the repo_path function of main.py. Untrusted input supplied to the command argument is passed to an operating system command without sanitization, allowing an attacker to inject and execute arbitrary commands. The product does not use conventional versioning, preventing identification of specific affected or fixed releases, and the vendor did not respond to early disclosure notification.
An unauthenticated remote attacker can exploit the flaw over the network by supplying a crafted command value, resulting in limited impacts to confidentiality, integrity, and availability on the affected system. The issue is tracked under CWE-74 and CWE-77, carries a CVSS 4.0 score of 5.5, and has had a public exploit released.
Public references consist of a GitHub issue and Vuldb entries that document the disclosure but contain no vendor patch, workaround, or mitigation guidance. The associated EPSS score has remained low and essentially flat at approximately 0.021.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25656
Vulnerability details
A vulnerability has been found in Divyanshu-hash GitPilot-MCP up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd. This impacts the function repo_path of the file main.py. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been…
more
disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mcp
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in a remotely accessible function allows arbitrary OS command execution without authentication, directly enabling exploitation of public-facing applications (T1190) and use of command/scripting interpreters for execution (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents command injection by requiring validation of the untrusted 'command' argument passed to the repo_path function in main.py.
Requires identification and correction of the specific command injection flaw in GitPilot-MCP up to commit 9ed9f153ba4158a2ad230ee4871b25130da29ffd, despite lack of vendor patch.
Limits potential impact of remotely injected OS commands by enforcing least privilege on the process handling the vulnerable repo_path function.