CVE-2025-68144

Name of the Vulnerable Software and Affected Versions mcp-server-git versions prior to 2025.12.17

Description The

git diff

and

git checkout

functions in mcp-server-git did not properly sanitize user-controlled arguments before passing them to git CLI commands. Specifically, flag-like values, such as

--output=/path/to/file

for

git diff

, were treated as command-line options instead of git references, potentially allowing arbitrary file overwrites. The issue is addressed by adding validation to reject arguments starting with - and verifying that the argument resolves to a valid git ref using

rev parse

before execution.

Recommendations Update to version 2025.12.17 to resolve this issue.