Loading vulnerability…
Path validation bypass in mcp-server-git --repository restriction
CVE-2025-68145 affects mcp-server-git versions prior to 2025.12.18. When the server is started with the --repository flag intended to restrict operations to a specific repository path, subsequent tool calls that supply repo_path were not validated against that configured path. As a result, the server trusted the caller-provided repo_path and could perform Git operations against repositories outside the intended boundary. Reported fixes add canonical path validation by resolving both the configured repository path and the requested path, following symlinks, and verifying that the requested path is contained within the allowed repository before executing Git operations.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows bypass of the repository confinement enforced by the --repository option, enabling access to other repositories reachable by the server process rather than only the administrator-approved repository. This can expose repository contents to the AI/LLM context and broaden the scope of Git operations available to an attacker. In reported chained scenarios, this boundary bypass can contribute to arbitrary file access and, when combined with other mcp-server-git flaws and a writable Filesystem MCP capability, remote code execution.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, avoid relying on --repository as a sole security boundary. Restrict the server process filesystem permissions so it can access only the intended repository, run the service under a dedicated least-privilege account, isolate it in a container or sandbox with a minimal mounted filesystem, and avoid exposing it alongside file-writing MCP tools where possible. Monitor for tool calls referencing unexpected repository paths and for access to repositories outside the approved scope.
Patch, then assume compromise.
Upgrade mcp-server-git to version 2025.12.18 or later. The fix validates requested repo_path values against the configured --repository root after path resolution and symlink handling, preventing operations outside the allowed repository.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.