---
id: CVE-2025-68144
aliases:
  - GHSA-9xwc-hfwc-8w59
  - PYSEC-2026-1622
title: ' mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files'
summary: ' mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files'
severity: medium
vendor: mcp-server-git
product: mcp-server-git
ecosystem: pip
affected:
  - mcp-server-git < 2025.12.18
patched:
  - mcp-server-git 2025.12.18
published: '2025-12-17'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9xwc-hfwc-8w59'
references:
  - url: >-
      https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-9xwc-hfwc-8w59
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68144'
  - url: 'https://github.com/modelcontextprotocol/servers'
tags:
  - osv
  - pip
epss: 0.07209
epssPercentile: 0.94092
ingestedAt: '2026-07-08T18:25:48.124Z'
---

## Overview

In mcp-server-git versions prior to 2025.12.18, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) would be interpreted as command-line options rather than git refs, enabling arbitrary file overwrites. The fix adds validation that rejects arguments starting with - and verifies the argument resolves to a valid git ref via rev_parse before execution. Users are advised to update to 2025.12.18 resolve this issue.

Thank you to https://hackerone.com/yardenporat for reporting.

## Affected packages

- `mcp-server-git < 2025.12.18`

## Remediation

Upgrade to a patched release:

- `mcp-server-git 2025.12.18`