Executive brief
mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
Affected products
- PyPI mcp-server-git
Junglewise Threat Intelligence
CVE-2026-27735: PYSEC-2026-2630 - mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
CVE-2026-27735 · Severity: medium · CVSS 4 · Published 2026-07-13
Technologies: mcp-server-git (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1623 - mcp-server-git has missing path validation when using --repository flag
- PYSEC-2026-1622 - mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
- PYSEC-2026-1621 - mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations