mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

🗓️ 07 Jul 2026 16:03:13Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 2 Views

MCP server git_diff and git_checkout accepted user args enabling overwrites; fixed.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2025-68144	18 Dec 202501:22	–	circl
CNNVD	Model Context Protocol Servers 参数注入漏洞	17 Dec 202500:00	–	cnnvd
CVE	CVE-2025-68144	17 Dec 202522:10	–	cve
Cvelist	CVE-2025-68144 mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files	17 Dec 202522:10	–	cvelist
EUVD	EUVD-2025-204003	17 Dec 202522:50	–	euvd
Github Security Blog	mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files	17 Dec 202522:50	–	github
NVD	CVE-2025-68144	17 Dec 202523:16	–	nvd
OSV	CVE-2025-68144 mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files	17 Dec 202522:10	–	osv
OSV	GHSA-9XWC-HFWC-8W59 mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files	17 Dec 202522:50	–	osv
OSV	PYSEC-2026-1622 mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files	7 Jul 202616:03	–	osv

Vulners

Node

pypi mcp-server-gitRange0–2025.12.18

Source	Link
github	www.github.com/modelcontextprotocol/servers/security/advisories/GHSA-9xwc-hfwc-8w59
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-68144
github	www.github.com/modelcontextprotocol/servers
pypi	www.pypi.org/project/mcp-server-git
github	www.github.com/advisories/GHSA-9xwc-hfwc-8w59

07 Jul 2026 17:24Current

6.2Medium risk

Vulners AI Score6.2

CVSS 46.3

CVSS 3.17.1

EPSS0.0728