Executive brief
mcp-server-git has missing path validation when using --repository flag
Affected products
- PyPI mcp-server-git
Junglewise Threat Intelligence
CVE-2025-68145: PYSEC-2026-1623 - mcp-server-git has missing path validation when using --repository flag
CVE-2025-68145 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: mcp-server-git (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2630 - mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
- PYSEC-2026-1622 - mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
- PYSEC-2026-1621 - mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations