Read the docs
TI-2025-41724 Aliases CVE-2025-68143GHSA-5cgr-j3jf-jw3v

mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

Priority MEDIUM 46CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, git_init could operate on any directory accessible to the server process, making those directories eligible for subsequent git operations. The tool was removed entirely, as the server is intended to operate on existing repositories only. Users are advised to upgrade to 2025.9.25 or newer to remediate this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.08134 94th percentileScored 2026-11-07
Fix Fixed servers (modelcontextprotocol): 2025.9.25mcp-server-git (PyPI): 2025.9.25

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowserversbefore 2025.9.252025.9.25Patch availableCNA
—mcp-server-git (PyPI)before 2025.9.252025.9.25Patch availableGHSA-5cgr-j3jf-jw3v
  • servers VendorMLflow Affected before 2025.9.25 Fixed in 2025.9.25 Patch available CNA
  • mcp-server-git (PyPI) Vendor— Affected before 2025.9.25 Fixed in 2025.9.25 Patch available GHSA-5cgr-j3jf-jw3v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:model_context_protocol_servers:*:*:*:*:*:*:*:*before 2025.9.25VulnerableMLflow
  • cpe:2.3:a:lfprojects:model_context_protocol_servers:*:*:*:*:*:*:*:* Versions before 2025.9.25 Vulnerable ·MLflow

Remediation

  • Fix · CNA servers (modelcontextprotocol) Fixed in 2025.9.25
  • Fix · GHSA-5cgr-j3jf-jw3v mcp-server-git (PyPI) Fixed in 2025.9.25 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68143
  2. 2026-10-03 Alias added: GHSA-5cgr-j3jf-jw3v

References

Patch 1

Advisory 2

Other 1

  • TI-2025-41726 mcp-server-git has missing path validation when using --repository flag CVSS 4.0MEDIUM 6.4
  • TI-2025-41725 mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files CVSS 4.0MEDIUM 6.3
  • TI-2026-22095 mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries CVSS 4.0MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences