Read the docs
TI-2026-22095 Aliases CVE-2026-27735GHSA-vjqx-cfc4-9h6v

mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

Priority LOW 28CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries. Because the tool used GitPython's repo.index.add() rather than the Git CLI, relative paths containing `../` sequences that resolve outside the repository were accepted and staged into the Git index. Users are advised to upgrade to 2026.1.14 or newer to remediate this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00345 28th percentileScored 2026-11-07
Fix Fixed servers (modelcontextprotocol): 2026.1.14mcp-server-git (PyPI): 2026.1.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowserversbefore 2026.1.142026.1.14Patch availableCNA
—mcp-server-git (PyPI)before 2026.1.142026.1.14Patch availableGHSA-vjqx-cfc4-9h6v
  • servers VendorMLflow Affected before 2026.1.14 Fixed in 2026.1.14 Patch available CNA
  • mcp-server-git (PyPI) Vendor— Affected before 2026.1.14 Fixed in 2026.1.14 Patch available GHSA-vjqx-cfc4-9h6v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:model_context_protocol_servers:*:*:*:*:*:*:*:*before 2026.1.14VulnerableMLflow
  • cpe:2.3:a:lfprojects:model_context_protocol_servers:*:*:*:*:*:*:*:* Versions before 2026.1.14 Vulnerable ·MLflow

Remediation

  • Fix · CNA servers (modelcontextprotocol) Fixed in 2026.1.14
  • Fix · GHSA-vjqx-cfc4-9h6v mcp-server-git (PyPI) Fixed in 2026.1.14 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27735
  2. 2026-10-03 Alias added: GHSA-vjqx-cfc4-9h6v

References

Patch 2

Advisory 1

Other 2

  • TI-2025-41724 mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations CVSS 4.0MEDIUM 6.5
  • TI-2025-41726 mcp-server-git has missing path validation when using --repository flag CVSS 4.0MEDIUM 6.4
  • TI-2025-41725 mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences