Multiple vulnerabilities found in Anthropic's Git MCP server

"Cyata discovered three separate security vulnerabilities in the server. The first concerns an unrestricted git_init function that allows repository initialization on arbitrary file system paths (CVE-2025-68143). In addition, there is a path validation bypass that allows access to repositories outside the configured allowlist (CVE-2025-68145). Finally, Cyata found an argument injection error in the git_diff tool, whereby unsanitized input is passed to the Git command-line interface (CVE-68144)."

"These three cyber threats are particularly serious, because individually they would have been much less interesting to attackers. When exploits of these vulnerabilities are combined, attackers can read or delete arbitrary files and overwrite files on the host system. The risk increases significantly when the Git MCP server is used in conjunction with the Filesystem MCP server. In that situation, attackers can exploit Git's smudge and clean filters to execute shell commands defined in repository configuration files."

"Anthropic created the Model Context Protocol. Security was not necessarily a key focus in order to accelerate adoption. However, it now appears that Anthropic's own Git MCP server has been vulnerable to multiple vulnerabilities. This is despite the fact that it is the reference implementation of MCP for Git; the vulnerability has since been patched. All implementations that closely followed Anthropic's example and date from before December 18 are vulnerable."

Anthropic's mcp-server-git reference implementation contained multiple security flaws that were later patched. Cyata Security discovered three high-impact vulnerabilities: an unrestricted git_init allowing repository initialization on arbitrary file system paths (CVE-2025-68143); a path validation bypass permitting access to repositories outside the configured allowlist (CVE-2025-68145); and an argument injection in git_diff that passes unsanitized input to the Git CLI (CVE-68144). Combined exploitation enables attackers to read, delete, or overwrite arbitrary host files. The risk escalates when used with the Filesystem MCP server, where Git smudge and clean filters can be abused to execute shell commands from repository configuration files. Implementations predating December 18 that followed the reference are vulnerable.

Read at Techzine Global