Description
git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths accessible by the process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
cyanheads git-mcp-server
Default version status: unaffected
0 to ≤ 2.15.3affected
pkg:npm/%40cyanheads/git-mcp-serverReferences
- https://github.com/cyanheads/git-mcp-server/issues/53 ↗
- https://github.com/cyanheads/git-mcp-server ↗
- https://github.com/cyanheads/git-mcp-server/blob/v2.15.3/src/services/git/providers/cli/operations/commits/log.ts ↗
- https://github.com/cyanheads/git-mcp-server/blob/v2.15.3/src/services/git/providers/cli/utils/command-builder.ts ↗
- https://www.vulncheck.com/advisories/git-mcp-server-2.15.1-argument-injection-via-git-ref-parameters ↗