CVE-2025-68144 mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
Attackers can overwrite local files by injecting command-line flags into git_diff and git_checkout functions in the MCP Git server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-68144?
CVE-2025-68144 is a medium-severity command injection vulnerability in modelcontextprotocol servers, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) would be interpreted as command-line options rather than git refs, enabling arbitrary file overwrites. The fix adds validation that rejects arguments starting with - and verifies the argument resolves to a valid git ref via rev_parse before execution. Users are advised to update to 2025.12.17 resolve this issue when it is released.
Weakness: CWE-88
Which versions are affected by CVE-2025-68144?
3 open source packages ship an affected version, including mcp-server-git. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mcp-server-git PyPI | All versions | 2025.12.18 |
mcp-server-git PyPI | All versions | 2025.12.18 |
mcp-server-git PyPI | All versions | 2025.12.18 |
Products include Lfprojects Model Context Protocol Servers.
How do I fix CVE-2025-68144?
Upgrade mcp-server-git to 2025.12.18 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-68144 being exploited?
There is no known exploitation of CVE-2025-68144 in the wild and no public exploit code.
Other vulnerabilities in modelcontextprotocol servers
- CVE-2025-68143 mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
- CVE-2026-27735 mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
- CVE-2025-68145 mcp-server-git has missing path validation when using --repository flag
Sources
Also known as GHSA-9xwc-hfwc-8w59, MINI-pw8c-f933-247p, PYSEC-2026-1622.