Read the docs
TI-2025-41725 Aliases CVE-2025-68144GHSA-9xwc-hfwc-8w59

mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

Priority MEDIUM 44CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-88.

Summary

In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) would be interpreted as command-line options rather than git refs, enabling arbitrary file overwrites. The fix adds validation that rejects arguments starting with - and verifies the argument resolves to a valid git ref via rev_parse before execution. Users are advised to update to 2025.12.17 resolve this issue when it is released.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07209 94th percentileScored 2026-11-07
Fix Fixed servers (modelcontextprotocol): 2025.12.17mcp-server-git (PyPI): 2025.12.18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowserversbefore 2025.12.172025.12.17Patch availableCNA
—mcp-server-git (PyPI)before 2025.12.182025.12.18Patch availableGHSA-9xwc-hfwc-8w59
  • servers VendorMLflow Affected before 2025.12.17 Fixed in 2025.12.17 Patch available CNA
  • mcp-server-git (PyPI) Vendor— Affected before 2025.12.18 Fixed in 2025.12.18 Patch available GHSA-9xwc-hfwc-8w59

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:model_context_protocol_servers:*:*:*:*:*:*:*:*before 2025.12.17VulnerableMLflow
  • cpe:2.3:a:lfprojects:model_context_protocol_servers:*:*:*:*:*:*:*:* Versions before 2025.12.17 Vulnerable ·MLflow

Remediation

  • Fix · CNA servers (modelcontextprotocol) Fixed in 2025.12.17
  • Fix · GHSA-9xwc-hfwc-8w59 mcp-server-git (PyPI) Fixed in 2025.12.18 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68144
  2. 2026-10-03 Alias added: GHSA-9xwc-hfwc-8w59

References

Advisory 2

Other 1

  • TI-2025-41724 mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations CVSS 4.0MEDIUM 6.5
  • TI-2025-41726 mcp-server-git has missing path validation when using --repository flag CVSS 4.0MEDIUM 6.4
  • TI-2026-22095 mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries CVSS 4.0MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences