mcp-server-git at a glance
Cyata disclosed on January 20, 2026 three fixed bugs in mcp-server-git: an unrestricted git_init tool, argument injection in git_diff and git_checkout, and a --repository path bypass. Combined with a filesystem MCP server, they could lead to code execution. Update to 2025.12.18 or later.
mcp-server-git: status
- Affected
- mcp-server-git before 2025.9.25 (CVE-2025-68143, git_init)
- mcp-server-git before 2025.12.18 (CVE-2025-68144 and CVE-2025-68145)
- CVE identifiers
- Status as of
- Discovered by
- Yarden Porat (Cyata)
What changed with mcp-server-git
Advisories in the modelcontextprotocol/servers repository describe three issues. CVE-2025-68143: git_init accepted any filesystem path and created a repository there; the tool was removed in 2025.9.25. CVE-2025-68144: git_diff and git_checkout passed flag-like values such as --output straight to the git CLI, allowing file overwrites. CVE-2025-68145: when started with --repository, the server did not check that later repo_path arguments stayed inside that repository. GitHub lists the advisories as published on December 17, 2025; Cyata’s research write-up, which brought them to wider attention, followed on January 20, 2026.
Cyata researcher Yarden Porat, credited in the advisories through HackerOne, showed how instructions planted in content an agent reads, such as a README or an issue, could make the agent create a repository, write a script with a filesystem MCP server, and add Git filters in .git/config that run it. The Register reported no sign of exploitation. GitHub rates each advisory medium, while NVD scores them high to critical.
How to fix it: mcp-server-git
1. Update
Update mcp-server-git to 2025.12.18 or later, which removes git_init, rejects flag-like refs, and enforces the --repository boundary.
github.com (opens in a new tab)
Advisories
Where to compare mcp-server-git
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why mcp-server-git matters for businesses
Reference servers are copied and installed widely, and the danger came from combining tools rather than from any single bug. Businesses running coding or ops agents should update mcp-server-git to 2025.12.18 or later, think twice before enabling Git and filesystem MCP servers together, and assume any text an agent reads may try to steer its tool calls.
Sources for this story
- Unrestricted git_init tool allows repository creation at arbitrary filesystem locations in mcp-server-git (opens in a new tab)Official
GitHub Security Advisory (Model Context Protocol) · github.com
- Argument injection in git_diff and git_checkout functions for mcp-server-git allows overwriting local files (opens in a new tab)Official
GitHub Security Advisory (Model Context Protocol) · github.com
- Missing path validation when using --repository flag in mcp-server-git (opens in a new tab)Official
GitHub Security Advisory (Model Context Protocol) · github.com
- CVE-2025-68145 (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
- Anthropic quietly fixed flaws in its Git MCP server that allowed for remote code execution (opens in a new tab)Press
The Register · theregister.com
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #mcp
- #anthropic
- #prompt-injection
- #git