Anthropic MCP Server Flaws Lead to Code Execution, Data Exposure

Anthropic MCP Server Flaws Lead to Code Execution, Data Exposure reports that flaws in Anthropic’s MCP server connections to local data can be exploited to achieve remote code execution and unauthorized file access. All three vulnerabilities were identified in the official Git MCP server (mcp-server-git) and could be exploited via prompt injections with attacker-controlled arguments, potentially enabling arbitrary code execution, reading files, and deleting files, with the attack working against any configuration.

The bugs are tracked as CVE-2025-68143, CVE-2025-68145, and CVE-2025-68144, arising because the Git MCP server failed to validate or sanitise certain inputs. According to Cyata, a malicious actor who can influence the AI’s context can trigger MCP tool calls with manipulated arguments, allowing exploitation even without direct access to the victim’s system.

SecurityWeek notes that the firm first reported the issues to Anthropic in June and July 2025, and Anthropic resolved all three vulnerabilities in December 2025 in mcp-server-git version 2025.12.18.