AI agent vulnerability · MCP reference servers

CVE-2025-68144: mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

mediumCVSS 4.0 6.3GHSA-9xwc-hfwc-8w59

In mcp-server-git versions prior to 2025.12.18, the gitdiff and gitcheckout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., --output=/path/to/file for gitdiff) would be interpreted as command-line options rather than git refs, enabling arbitrary file overwrites.

Published Dec 17, 2025 · Updated Dec 20, 2025

Affected packages

mcp-server-git

Ecosystem: PyPI
Affected: < 2025.12.18
Fixed in: 2025.12.18
Check: pip show mcp-server-git

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In mcp-server-git versions prior to 2025.12.18, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., --output=/path/to/file for git_diff) would be interpreted as command-line options rather than git refs, enabling arbitrary file overwrites. The fix adds validation that rejects arguments starting with - and verifies the argument resolves to a valid git ref via rev_parse before execution. Users are advised to update to 2025.12.18 resolve this issue.

Thank you to https://hackerone.com/yardenporat for reporting.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More MCP reference servers vulnerabilities

All MCP reference servers entries