Attack Chain

1. The attacker identifies an instance of dvladimirov MCP running a version up to 0.1.0 with the Git Search API enabled.
2. The attacker crafts a malicious HTTP request targeting the Git Search API endpoint (/gitsearch).
3. Within the request, the attacker injects a command injection payload into either the repo_url or pattern argument. This payload leverages shell metacharacters (e.g., ;, |, &&) to chain malicious commands.
4. The MCP server receives the request and passes the unsanitized repo_url or pattern value to the GitSearchRequest function in mcp_server.py.
5. The GitSearchRequest function executes the injected command via a system call, effectively bypassing intended functionality.
6. The attacker gains arbitrary command execution on the server, potentially allowing them to read sensitive files, modify system configurations, or establish a reverse shell.
7. The attacker uses the reverse shell to further explore the network and escalate privileges.

Impact

Successful exploitation of this command injection vulnerability allows a remote attacker to execute arbitrary commands on the affected system. This can lead to complete system compromise, including data theft, modification, or destruction. Given the nature of MCP, which likely manages configurations and monitors other systems, a successful attack could cascade to other parts of the infrastructure, potentially affecting numerous systems across the network.

Recommendation

• Apply input validation and sanitization to the repo_url and pattern parameters within the GitSearchRequest function to prevent command injection.
• Deploy the Sigma rule Detect MCP Git Search API Command Injection Attempt to detect exploitation attempts targeting CVE-2026-7211.
• Monitor web server logs for suspicious requests containing shell metacharacters in the repo_url or pattern parameters as outlined in the Sigma rule and overview sections.
• Consider isolating or taking offline affected MCP instances until a patch is available to mitigate the risks associated with CVE-2026-7211.