Anthropic mcp-server-git Path Parameter Vulnerability: Multiple Security Flaws Detected, Urgent Update Recommended to the Fixed Version

OldLeekConfession · 2026-01-26T04:25:09+00:00

The mcp-server-git project by Anthropic has several serious security vulnerabilities due to insufficient validation of path parameters, allowing prompt injection attacks. Administrators and developers must urgently address these issues. The vulnerabilities include CVE-2025-68143, which permits malicious Git repository creation, and CVE-2025-68144, enabling argument injection in git commands. Users are strongly recommended to update to version 2025.12.18 to mitigate these risks.

OldLeekConfession

2026-01-26 04:25:09

Abstract generation in progress

Serious security vulnerabilities have been detected in the official mcp-server-git project maintained by Anthropic. These vulnerabilities are caused by improper validation of path parameters and could be exploited through prompt injection attacks. System administrators and developers are urged to respond immediately.

Major Risks Caused by Improper Path Parameter Validation

One of the identified vulnerabilities is CVE-2025-68143 (Unrestricted git_init). Since the repo_path parameter in mcp-server-git lacks path validation, an attacker can create Git repositories in arbitrary directories on the system. This path parameter vulnerability can lead to scenarios where malicious README files or compromised web pages cause users to inadvertently execute dangerous commands.

CVE-2025-68145 (Path Validation Bypass) shares a similar root cause and allows attackers to bypass system security boundaries.

Risks of Prompt Injection and Argument Injection Combined Attacks

CVE-2025-68144 (Argument Injection in git_diff) involves the possibility of malicious arguments being inserted into the git diff command. The severity increases when these vulnerabilities are exploited in conjunction with the file system MCP server.

By configuring a clean filter in the .git/config file, attackers can execute shell commands without permissions. This can lead to multi-stage attack scenarios, including arbitrary code execution, deletion of system files, and large language model context contamination with arbitrary file contents.

Security Response: Urgent Update Implementation

Anthropic officially assigned these CVE numbers on December 17, 2025, and released patch fixes. All users utilizing mcp-server-git are strongly recommended to update to version 2025.12.18 or later.

After updating, it is crucial to verify the git config settings to ensure no malicious clean filter configurations are present. Especially, confirm that path parameter validation is enabled and test that repository creation in unintended directories is prevented.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.