CVE-2025-68145Medium▾ Sunlitmcp-server-git has missing path validation when using --repository flag
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 1.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
6.2%
6.2% → 7.0%
In mcp-server-git versions prior to 2025.12.18, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could allow tool calls to operate on other repositories accessible to the server process. The fix adds path validation that resolves both the configured repository and the requested path (following symlinks) and verifies the requested path is within the allowed repository before executing any git operations. Users are advised to upgrade to 2025.12.18 to remediate this issue.
Thank you to https://hackerone.com/yardenporat for reporting.
mcp-server-git < 2025.12.18Upgrade to a patched release:
mcp-server-git 2025.12.18Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27735Mediummcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
CVE-2025-68144Mediummcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
CVE-2025-68143Mediummcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations