Prompt-injection chain enables code execution in Anthropic’s Git MCP server

Anthropic fixed three vulnerabilities in its official Git MCP server (mcp-server-git) that could be triggered via prompt injection and chained with other MCP tools to achieve remote code execution or destructive file operations. The issues were reported by agentic AI security firm Cyata, which demonstrated that attacker-controlled content an AI assistant might read (for example, a malicious README, poisoned issue text, or other untrusted context) could drive the LLM to invoke MCP tool calls with crafted arguments, enabling exploitation without the attacker having direct access to the victim host.

Cyata identified CVE-2025-68143 (unrestricted git_init), CVE-2025-68145 (path validation bypass), and CVE-2025-68144 (argument injection in git_diff). In combination—particularly when mcp-server-git is used alongside the Filesystem MCP server—the flaws could enable code execution, arbitrary file deletion/overwrite, and reading arbitrary files into the LLM context (with Cyata noting this does not inherently provide direct exfiltration). The vulnerabilities affected default deployments of mcp-server-git prior to version 2025.12.18; Anthropic was notified in June and shipped fixes in December, and there was no indication reported that the bugs were exploited in the wild.