Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

mcp-server-git

4 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 4 medium
Registry
PyPI

Advisories 4

  • CVE-2026-27735Medium 6.4

    mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

    Affected: fixed in 2026.1.14.

  • CVE-2025-68145Medium 6.4

    mcp-server-git has missing path validation when using --repository flag

    Affected: fixed in 2025.12.18.

  • CVE-2025-68144Medium 6.3

    mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

    Affected: fixed in 2025.12.18.

  • CVE-2025-68143Medium 6.5

    mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

    Affected: fixed in 2025.9.25.