Anthropic mcp-server-git Path Parameter Vulnerability: Multiple Security Flaws Detected, Urgent Update Recommended to the Fixed Version

Serious security vulnerabilities have been detected in the official mcp-server-git project maintained by Anthropic. These vulnerabilities are caused by improper validation of path parameters and could be exploited through prompt injection attacks. System administrators and developers are urged to respond immediately.

Major Risks Caused by Improper Path Parameter Validation

One of the identified vulnerabilities is CVE-2025-68143 (Unrestricted git_init). Since the repo_path parameter in mcp-server-git lacks path validation, an attacker can create Git repositories in arbitrary directories on the system. This path parameter vulnerability can lead to scenarios where malicious README files or compromised web pages cause users to inadvertently execute dangerous commands.

CVE-2025-68145 (Path Validation Bypass) shares a similar root cause and allows attackers to bypass system security boundaries.

Risks of Prompt Injection and Argument Injection Combined Attacks

CVE-2025-68144 (Argument Injection in git_diff) involves the possibility of malicious arguments being inserted into the git diff command. The severity increases when these vulnerabilities are exploited in conjunction with the file system MCP server.

By configuring a clean filter in the .git/config file, attackers can execute shell commands without permissions. This can lead to multi-stage attack scenarios, including arbitrary code execution, deletion of system files, and large language model context contamination with arbitrary file contents.

Security Response: Urgent Update Implementation

Anthropic officially assigned these CVE numbers on December 17, 2025, and released patch fixes. All users utilizing mcp-server-git are strongly recommended to update to version 2025.12.18 or later.

After updating, it is crucial to verify the git config settings to ensure no malicious clean filter configurations are present. Especially, confirm that path parameter validation is enabled and test that repository creation in unintended directories is prevented.