CVE-2026-85626 in git-mcp-server
Summary
by MITRE • 09/04/2026
git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths accessible by the process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The identified vulnerability in git-mcp-server version 2.15.1 represents a critical argument injection flaw within the core Git interaction tools, specifically affecting the ref and object parameters of the git_log, git_diff, and git_show functionalities. This security defect stems from an insufficient validation mechanism that fails to enforce strict leading-dash checks on user-supplied input before it is passed to underlying system commands. In standard command-line interfaces for version control systems like Git, arguments prefixed with double hyphens are interpreted as options or flags rather than repository references such as branch names, commit hashes, or file paths. By omitting this crucial validation step, the application inadvertently allows an attacker to manipulate the structure of the executed git command, transforming what should be a data parameter into a control sequence that alters program behavior in unintended and potentially malicious ways.
From a technical perspective, the exploitation vector relies on the ability to inject specific Git options, such as --output=, which are designed to redirect standard output or error streams to arbitrary file locations. When an attacker supplies input like "--output=/etc/passwd" within the ref or object parameter fields, the git-mcp-server processes this string without sanitization and passes it directly to the operating system's command interpreter. Consequently, instead of performing a legitimate log review, diff analysis, or show operation on the specified repository reference, the process executes the injected option. This allows for arbitrary file writes to any path where the server process possesses write permissions, effectively bypassing intended sandboxing or isolation boundaries that might otherwise restrict access to sensitive system directories or configuration files outside the designated repository root.
The operational impact of this vulnerability is severe, as it facilitates unauthorized data exfiltration and potential remote code execution depending on the context in which the file writes are utilized. An attacker can overwrite critical configuration files, inject malicious scripts into executable paths, or plant web shells if the server has access to a web-serving directory. This capability undermines the integrity of the system by allowing persistent backdoors and compromises confidentiality through the reading of sensitive data via redirected output streams. Furthermore, because this vulnerability exists in widely used Git interaction tools within an MCP (Model Context Protocol) server environment, it poses a significant risk to applications that rely on automated code analysis or repository management, potentially leading to broader compromise of the hosting infrastructure if not promptly addressed.
To mitigate this risk, immediate remediation should focus on implementing strict input validation and parameterization strategies for all user-supplied data passed to external commands. Developers must enforce a whitelist approach where only alphanumeric characters, hyphens (when not at the start), slashes, and dots are permitted in ref and object parameters, while explicitly rejecting any string that begins with double hyphens or other special command-line delimiters. Additionally, adopting safe API calls instead of shell-based execution can further reduce attack surface by avoiding direct interpretation of user input as executable arguments. Organizations should also apply the latest security patches provided by the git-mcp-server maintainers and monitor for updates addressing this specific CWE-78 issue, which is categorized under Improper Neutralization of Special Elements used in an OS Command according to industry standards like MITRE ATT&CK technique T1059.