Executive brief
A security vulnerability exists in git-mcp-server, a tool that allows AI agents and LLMs to interact with Git repositories. An attacker can use specially crafted Git commit messages or direct inputs to trick the AI into executing unauthorized system commands on the host machine. This could lead to a full system takeover, data theft, or service disruption.
Technical details
A command injection vulnerability exists in @cyanheads/git-mcp-server due to the use of the 'child_process.exec' function with unsanitized user input. The server constructs shell commands by concatenating strings with parameters like branch names or file paths, allowing attackers to inject shell metacharacters (e.g., |, &&, >). A notable attack vector involves 'indirect prompt injection,' where a malicious Git commit message contains instructions that trick an LLM client into calling vulnerable tools with malicious arguments. The vulnerability affects multiple tools including git_add, git_init, and git_logs. The issue is resolved in version 2.1.5 by migrating to 'child_process.execFile', which handles arguments safely without shell interpretation.
Affected products
- cyanheads git-mcp-server < 2.1.5
Timeline
- 2025-06-29: advisory: GitHub advisory published
- 2025-06-30: disclosed
- 2025-06-30: patched: Version 2.1.5 released