Executive brief
git-mcp-server is an AI-agent interface to Git repositories. The vulnerability allows attackers to inject arbitrary git command-line options through the ref and object parameters, enabling them to write files to any location on the file system that the process can access. This could lead to arbitrary file writes, configuration tampering, or code execution depending on the deployment context.
Technical details
An argument injection vulnerability exists in the git_log, git_diff, and git_show tools of git-mcp-server 2.15.1 due to insufficient validation of the ref and object parameters. The parameters lack leading-dash validation, allowing attackers to inject git command options such as --output= to write files outside the repository. The vulnerability is reachable over the network if the MCP server is exposed and does not require authentication beyond the initial connection. An attacker can achieve arbitrary file write on the host system, potentially leading to configuration tampering, code execution, or other system compromise. Patch available in version 2.15.3 or later.
Affected products
- cyanheads git-mcp-server 2.15.1
Timeline
- 2026-09-04: disclosed
- 2026: patched: Fix available in version 2.15.3 or later