AI agent vulnerability · MCP reference servers

CVE-2025-68143: mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

mediumCVSS 4.0 6.5GHSA-5cgr-j3jf-jw3v

In mcp-server-git versions prior to 2025.9.25, the gitinit tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, gitinit could operate on any directory accessible to the server process, making those directories eligible for subsequent git operations.

Published Dec 17, 2025 · Updated Dec 20, 2025

Affected packages

mcp-server-git

Ecosystem: PyPI
Affected: < 2025.9.25
Fixed in: 2025.9.25
Check: pip show mcp-server-git

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, git_init could operate on any directory accessible to the server process, making those directories eligible for subsequent git operations. The tool was removed entirely, as the server is intended to operate on existing repositories only. Users are advised to upgrade to 2025.9.25 or newer to remediate this issue.

Thank you to https://hackerone.com/yardenporat for disclosure, @0dd for contributing the fix.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More MCP reference servers vulnerabilities

All MCP reference servers entries