CVE-2025-68144: mcp-server-git Argument Injection Vulnerability Leading to Local File Overwrites
Summary
CVE-2025-68144: In mcp-server-git versions prior to 2025.12.18, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Affects mcp-server-git versions < 2025.12.18. Fixed in 2025.12.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mcp-server-git is a Python package that facilitates interactions with Git repositories through a server interface. It provides functionalities such as diffing and checking out branches. However, prior to version 2025.12.18, it was vulnerable to argument injection, allowing malicious users to manipulate commands executed by the package.
Vulnerability Detail
The vulnerability arises from the git_diff and git_checkout functions, which directly pass user-controlled arguments to git CLI commands without proper sanitization. This oversight allows attackers to inject flag-like values (e.g., --output=/path/to/file), which are interpreted as command-line options instead of git references. Consequently, this can lead to arbitrary file overwrites on the local filesystem, posing a significant security risk.
How To Fix
Minimum fixed version
2025.12.18
This is the first release that contains the fix.
pip install --upgrade "mcp-server-git==2025.12.18"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid passing any user-controlled arguments directly to the git_diff and git_checkout functions until the package is updated. Additionally, ensure that any file paths provided do not start with a hyphen (-) to prevent command-line option interpretation.
Conclusion
The mcp-server-git package has a significant vulnerability that allows for argument injection, leading to potential local file overwrites. Users are strongly advised to update to version 2025.12.18 or later to mitigate this risk. For those unable to update immediately, temporary workarounds are available to reduce exposure.
See every vulnerability recorded for mcp-server-git →
FAQ
The vulnerability allows for argument injection in git commands, potentially leading to arbitrary file overwrites.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.3, indicating a moderate level of severity.
If an immediate update is not possible, avoid using the vulnerable functions with user-controlled inputs and ensure that no arguments start with a hyphen.
The vulnerability was reported by a user on HackerOne, specifically by the user with the handle yardenporat.
Related vulnerabilities
Recent vulnerabilities recorded for mcp-server-git.
