Anthropic Git MCP Server Found Vulnerable to Code Execution Attacks

Three critical vulnerabilities in mcp-server-git, Anthropic’s official Git Model Context Protocol (MCP) server.

The flaws enable attackers to execute arbitrary code, delete files, and read sensitive data through prompt injection attacks without requiring direct system access. All versions before 2025.12.18 are affected.

The Model Context Protocol, introduced by Anthropic in November 2024, enables AI assistants to interact with external systems including Git repositories, filesystems, and APIs.

MCP servers act as intermediaries between language models and these tools. The critical vulnerability: MCP servers execute actions based on LLM decisions, and LLMs are susceptible to prompt injection attacks.

An attacker who can influence AI context through a malicious README file, poisoned GitHub issue, or a compromised webpage can weaponise these vulnerabilities without direct system access.

CVE ID	Vulnerability Type	Impact	CVSS Score
CVE-2025-68143	Unrestricted git_init	Arbitrary directory access and file operations	Critical
CVE-2025-68144	Argument Injection in git_diff	Arbitrary file deletion via –output flag	Critical
CVE-2025-68145	Path Validation Bypass	Unauthorized repository access	High

These vulnerabilities work on any default configuration of mcp-server-git, making them particularly dangerous for users of AI-powered IDEs like Cursor, Windsurf, and GitHub Copilot.

From Path Bypass to Code Execution

The Root Cause

The mcp-server-git implementation accepts repository paths directly from LLM arguments without validating them against the configured –repository flag. This allows attackers to access any Git repository on the system.

textrepo_path = Path(arguments["repo_path"])  # No validation
repo = git.Repo(repo_path)  # Uses attacker-controlled path

Arbitrary File Deletion

By combining git_init and git_diff, attackers can delete arbitrary files. The git_diff function passes the target parameter directly to the Git CLI without sanitization:

textgit diff --unified=3 --output=/home/user/.bashrc

This command writes diff output to .bashrc, effectively overwriting and deleting the file. Using git_init, attackers can convert sensitive directories like ~/.ssh into repositories, then manipulate their contents, as reported by Cyata.

To achieve remote code execution, attackers leverage Git’s smudge and clean filters shell commands executed during file staging without requiring execute permissions. The attack sequence involves:

1. Using git_init to create a repository in a writable directory
2. Writing a malicious .git/config via Filesystem MCP server
3. Configuring clean filters to execute arbitrary shell commands
4. Staging files to trigger filter execution during git_add

This bypasses the need for execute bit permissions on files, making RCE viable in restrictive environments.

These vulnerabilities enable attackers to:

• Execute arbitrary code on systems running vulnerable versions
• Delete critical system and user files
• Exfiltrate sensitive data into AI context
• Compromise Git configurations and SSH credentials

The vulnerabilities affect any organization using mcp-server-git versions prior to 2025.12.18 with AI-powered development environments.

Immediate Action: Update mcp-server-git to version 2025.12.18 or later. Users should review Git repositories and configurations that were accessible to LLMs during the vulnerable period.

Mitigation: Implement input validation for repository paths, disable untrusted MCP servers, and monitor for suspicious Git operations in logs.

Anthropic has patched the vulnerabilities in the latest release. Users of AI-powered IDEs should prioritize updating MCP servers and conducting security audits of their development environments.

This disclosure highlights the security implications of LLM-controlled tool execution a critical consideration as AI integration in development workflows expands.

Follow us on Google News, LinkedIn, and X to Get Instant Updates ancd Set GBH as a Preferred Source in Google.