Anthropic Git MCP Server Vulnerabilities Involving Path Traversal and Argument Injection

Security researchers disclosed three vulnerabilities in mcp-server-git, the official Git server implementation for the Model Context Protocol (MCP) used by Anthropic.

The flaws, now fixed, are CVE-2025-68143 (CVSS 6.5) path traversal in git_init, CVE-2025-68145 (CVSS 6.4) another path traversal bypass, and CVE-2025-68144 (CVSS 6.3) an argument injection flaw that passes unsanitised input to Git CLI commands, which together expand the attack surface and enable unauthorized file access, deletion or potential code execution when chained with filesystem access.

The vulnerabilities can be triggered via prompt injection, allowing an attacker to influence the model by content in a README, issue description or webpage to cause the AI to invoke Git tools with malicious parameters, effectively making the AI an intermediary. Any environment running mcp-server-git versions prior to 2025.12.18 is affected, with Anthropic addressing the issues by removing the vulnerable git_init tool and tightening path validation, and users advised to upgrade immediately.

According to SOCRadar, these findings underscore the growing intersection of AI tooling and development infrastructure and the need for real-time vulnerability intelligence to prioritise remediation. The disclosure highlights real-world impacts such as reading arbitrary files, deleting or overwriting files, and potential remote code execution under default configurations.