Read the docs
TI-2025-41726 Aliases CVE-2025-68145GHSA-j22h-9j4x-23w5

mcp-server-git has missing path validation when using --repository flag

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could allow tool calls to operate on other repositories accessible to the server process. The fix adds path validation that resolves both the configured repository and the requested path (following symlinks) and verifies the requested path is within the allowed repository before executing any git operations. Users are advised to upgrade to 2025.12.17 upon release to remediate this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07032 94th percentileScored 2026-11-07
Fix Fixed servers (modelcontextprotocol): 2025.12.17mcp-server-git (PyPI): 2025.12.18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowserversbefore 2025.12.172025.12.17Patch availableCNA
—mcp-server-git (PyPI)before 2025.12.182025.12.18Patch availableGHSA-j22h-9j4x-23w5
  • servers VendorMLflow Affected before 2025.12.17 Fixed in 2025.12.17 Patch available CNA
  • mcp-server-git (PyPI) Vendor— Affected before 2025.12.18 Fixed in 2025.12.18 Patch available GHSA-j22h-9j4x-23w5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:model_context_protocol_servers:*:*:*:*:*:*:*:*before 2025.12.18VulnerableMLflow
  • cpe:2.3:a:lfprojects:model_context_protocol_servers:*:*:*:*:*:*:*:* Versions before 2025.12.18 Vulnerable ·MLflow

Remediation

  • Fix · CNA servers (modelcontextprotocol) Fixed in 2025.12.17
  • Fix · GHSA-j22h-9j4x-23w5 mcp-server-git (PyPI) Fixed in 2025.12.18 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68145
  2. 2026-10-03 Alias added: GHSA-j22h-9j4x-23w5

References

Advisory 2

Other 1

  • TI-2025-41724 mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations CVSS 4.0MEDIUM 6.5
  • TI-2025-41725 mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files CVSS 4.0MEDIUM 6.3
  • TI-2026-22095 mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries CVSS 4.0MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences