Three Flaws in Anthropic MCP Git Server Enable File Access and Code Execution

Three security flaws have been disclosed in mcp-server-git, the Anthropic-maintained Git Model Context Protocol server, potentially letting attackers read or delete arbitrary files and even execute code under certain conditions.

The flaws comprise CVE-2025-68143, CVE-2025-68144 and CVE-2025-68145, with CVSS scores of 8.8, 8.1 and 7.1 (v3) respectively, including a path traversal issue from git_init and a parameter handling weakness in git_diff/git_checkout, plus missing path validation when using the --repository flag.

The vulnerabilities can be triggered via prompt injection, meaning an attacker who can influence what an AI assistant reads could weaponise them without direct access to the victim’s system, according to The Hacker News quoting Cyata researcher Yarden Porat.

Successful exploitation could turn any directory on the system into a Git repository, overwrite files with an empty diff, and grant access to repositories on the server; Cyata documented a chain involving the Filesystem MCP server to achieve remote code execution.

In response, the git_init tool has been removed and extra path-traversal validation added; users should update to the latest version for protection, and Shahar Tal, CEO and co-founder of Cyata, said the canonical Git MCP server remains a critical reference point for scrutiny across the MCP ecosystem.