GHSA-5cgr-j3jf-jw3v
NoneCVSS
—
EPSS
—
Published
Dec 17, 2025
CISA due date
—
The record
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | mcp-server-git | 0 | 2025.9.25 |
Related vulnerabilities
- CVE-2025-68143 Model Context Protocol Servers is a collection of reference implementations for the model… Same vulnerability
- GHSA-vjqx-cfc4-9h6v mcp-server-git : Path traversal in git_add allows staging files outside repository… Also affects mcp-server-git
- CVE-2026-27735 Model Context Protocol Servers is a collection of reference implementations for the model… Also affects mcp-server-git
- CVE-2025-68145 In mcp-server-git versions prior to 2025.12.17, when the server is started with the… Also affects mcp-server-git
- CVE-2025-68144 In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions… Also affects mcp-server-git
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
- CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22