{"id":"CVE-2025-68144","aliases":["GHSA-9xwc-hfwc-8w59","PYSEC-2026-1622"],"title":" mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files","summary":" mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files","severity":"medium","vendor":"mcp-server-git","product":"mcp-server-git","ecosystem":"pip","affected":["mcp-server-git < 2025.12.18"],"patched":["mcp-server-git 2025.12.18"],"published":"2025-12-17","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9xwc-hfwc-8w59","references":[{"url":"https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-9xwc-hfwc-8w59"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68144"},{"url":"https://github.com/modelcontextprotocol/servers"}],"tags":["osv","pip"],"epss":0.07209,"epssPercentile":0.94032,"ingestedAt":"2026-07-08T18:25:48.124Z","slug":"CVE-2025-68144","body":"## Overview\n\nIn mcp-server-git versions prior to 2025.12.18, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) would be interpreted as command-line options rather than git refs, enabling arbitrary file overwrites. The fix adds validation that rejects arguments starting with - and verifies the argument resolves to a valid git ref via rev_parse before execution. Users are advised to update to 2025.12.18 resolve this issue.\n\nThank you to https://hackerone.com/yardenporat for reporting.\n\n## Affected packages\n\n- `mcp-server-git < 2025.12.18`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mcp-server-git 2025.12.18`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":27.5,"likelihood":1.4,"exploitation":0,"ransomware":0},"changes":[]}