Loading vulnerability…
Unrestricted git_init in Anthropic mcp-server-git
CVE-2025-68143 affects Anthropic's Model Context Protocol Git server, mcp-server-git. In versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and initialized a Git repository at the supplied location without validating that the path was within an intended or authorized repository boundary. Unlike other mcp-server-git tools that were intended to operate on an existing repository, git_init could be invoked on any directory accessible to the server process, effectively converting that directory into a Git repository and making it eligible for subsequent Git operations through the MCP server. Public reporting describes this as an unrestricted repository initialization / path traversal style flaw in path handling. Anthropic remediated the issue by removing the git_init tool entirely, reflecting that the server is intended to operate only on pre-existing repositories.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to initialize a Git repository in an arbitrary directory writable by or otherwise accessible to the mcp-server-git process. This expands the scope of directories that can then be manipulated through subsequent Git operations exposed by the MCP server. On its own, this can turn non-repository directories into Git-managed locations; in reported exploit chains, it can be combined with other MCP capabilities such as filesystem write access and additional mcp-server-git flaws to overwrite files and achieve code execution via malicious Git configuration and filters. The practical security impact therefore includes unauthorized modification of filesystem locations, expansion of attack surface beyond the intended repository, and enablement of chained RCE scenarios.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, disable or remove access to the git_init capability, and restrict the mcp-server-git process so it cannot write to arbitrary filesystem locations. Run the server with least privilege, constrain accessible directories using OS-level sandboxing or containerization, and avoid deploying it alongside file-writing MCP servers unless strictly necessary. Monitor for unexpected creation of .git directories in non-repository paths and review agent workflows for prompt-injection-driven tool invocation.
Patch, then assume compromise.
Upgrade mcp-server-git to version 2025.9.25 or later. Anthropic's fix removed the git_init tool from the server, eliminating the vulnerable functionality. Where possible, upgrade further to the latest available release, as related mcp-server-git issues were addressed in later versions including 2025.12.18.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.