git-mcp-server vulnerabilities

CVEs whose affected-version data names the git-mcp-server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-85626High· 7.5PoC

2w ago

git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= …

▾ Midnightcyanheads · git-mcp-serverEPSS 0.27%via CVEORG