Odaily Planet News: Three security vulnerabilities have been discovered in the official mcp-server-git maintained by Anthropic. These vulnerabilities can be exploited through prompt injection attack methods. Attackers can trigger the vulnerabilities by using malicious README files or compromised web pages, without requiring direct access to the victim's system.
These vulnerabilities include: CVE-2025-68143 (unrestricted git_init), CVE-2025-68145 (path validation bypass), and CVE-2025-68144 (parameter injection in git_diff). When combined with a file system MCP server, an attacker could execute arbitrary code, delete system files, or read the contents of arbitrary files into the context of a large language model.
Cyata points out that due to the lack of path validation for the repo_path parameter in mcp-server-git, attackers can create Git repositories in arbitrary directories on the system. Additionally, by configuring a clean filter in .git/config, attackers can execute shell commands without requiring execution permissions. Anthropic has assigned a CVE identifier and submitted a fix patch on December 17, 2025. Users are advised to update mcp-server-git to version 2025.12.18 or higher. (cyata)