Anthropic's official Git MCP server has multiple security vulnerabilities that could enable file read/write operations and potential remote code execution.

Three security vulnerabilities have been discovered in the official mcp-server-git repository maintained by Anthropic. These vulnerabilities can be exploited through prompt injection attacks, allowing attackers to trigger them via malicious README files or compromised web pages without direct access to the victim's system. These vulnerabilities include: CVE-2025-68143 (unrestricted git_init), CVE-2025-68145 (path validation bypass), and CVE-2025-68144 (parameter injection in git_diff). If these vulnerabilities are combined with the file system MCP server, attackers could execute arbitrary code, delete system files, or read arbitrary file contents into the large language model context. Cyata points out that because mcp-server-git does not validate the repo_path parameter, attackers can create Git repositories in arbitrary directories on the system. Furthermore, by configuring cleanup filters in .git/config, attackers can run shell commands without execution privileges. Anthropic assigned a CVE number and submitted a fix on December 17, 2025. Users are advised to update mcp-server-git to version 2025.12.18 or later. (cyata)