Loading vulnerability…
Argument Injection in Anthropic mcp-server-git git_diff and git_checkout
CVE-2025-68144 is an argument injection vulnerability in Anthropic's mcp-server-git. The git_diff and git_checkout functions pass user-controlled arguments through GitPython to Git CLI commands without sufficient validation. Values beginning with a hyphen can therefore be interpreted as command-line options rather than Git references. In git_diff, an attacker-controlled target can inject the Git output option to redirect diff output into an arbitrary file writable by the server process, potentially truncating it when the diff is empty. The vulnerability can be triggered through malicious MCP tool arguments, including arguments generated by an AI assistant following indirect prompt injection. Code execution has been demonstrated in broader attack chains involving additional Git MCP vulnerabilities and filesystem-writing capabilities; it is not established as a standalone consequence of this flaw.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises filesystem integrity by allowing attacker-directed overwriting or truncation of files within the server process's write permissions. Destruction of application data or configuration can cause service disruption. Combined with other Git MCP vulnerabilities and file-writing tools, exploitation can contribute to arbitrary code execution through malicious Git filter configuration. Arbitrary file reading and repository-boundary bypass are associated with companion vulnerabilities rather than established direct effects of CVE-2025-68144.
If you can’t patch tonight, do this now.
Until upgraded, disable or restrict access to git_diff and git_checkout, or enforce equivalent server-side validation of reference arguments. Run the MCP server with minimal filesystem permissions and isolate it from sensitive writable files. Review combined Git and filesystem-tool permissions, restrict unnecessary file-writing capabilities, and require approval for sensitive tool actions. Prompt-injection defenses alone do not correct the underlying argument injection.
Patch, then assume compromise.
Upgrade mcp-server-git to version 2025.12.18 or later. The argument-handling fix rejects reference arguments beginning with a hyphen and verifies that arguments resolve to valid Git references using rev_parse before execution. Although the initial vulnerability description identifies 2025.12.17 as the intended fixed version, subsequent release information identifies 2025.12.18 as the released fix.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.