// MCP INCIDENT -- RCE

Anthropic's Own Git MCP Server: Three Flaws, One Prompt Injection, Full Shell

high CVE-2025-68143 · Disclosed · 4 min read

Cyata Security disclosed three vulnerabilities in mcp-server-git, Anthropic's official reference implementation for Git operations over MCP, on January 20, 2026. Individually each flaw is a medium-severity path or argument issue. Chained with the Filesystem MCP server, they achieve arbitrary code execution through nothing more than a prompt injection, a malicious README or a poisoned GitHub issue body is enough to trigger the exploit without any direct access to the developer's machine. Anthropic patched the server in December 2025 after responsible disclosure in June 2025, removing the git_init tool entirely rather than attempting to restrict it.

What happened

Cyata Security researcher Yarden Porat found three vulnerabilities in mcp-server-git, the Python package Anthropic ships as its official reference implementation for exposing Git operations to LLMs.

CVE-2025-68145 (CVSS 7.1/6.3): The --repository flag is meant to restrict the server to a single repository path. It didn't. The per-call repo_path argument was never validated against the configured boundary, letting any operation escape to any repository on the filesystem.

CVE-2025-68143 (CVSS 8.8/6.5): The git_init tool accepted arbitrary filesystem paths without validation. It would create a git repository in any directory specified, including ~/.ssh or ~/.kube.

CVE-2025-68144 (CVSS 8.1/6.4): The git_diff and git_checkout functions passed user-controlled arguments directly to the GitPython library without sanitisation. Injecting --output=/path/to/file into the target field could overwrite or empty any file the server could reach.

The exploit chain: use CVE-2025-68145 to escape the configured repository boundary; use CVE-2025-68143 to initialise a git repository in ~/.ssh; write a malicious .git/config with a shell command hook using the Filesystem MCP server; trigger CVE-2025-68144 to fire git_diff against the config, executing the hook. The whole chain is triggerable via prompt injection, an attacker who controls a README, an issue body, or any web content the agent reads can deliver the exploit without any direct interaction with the developer's machine.

Anthropic's fix was definitive on git_init: the tool was removed from the package entirely. Path validation was added for the traversal issues and argument sanitisation applied to the Git CLI integration.

The PolicyLayer angle

This disclosure landed the same day BlueRock published its MarkItDown SSRF finding, and together they established January 20, 2026 as the day MCP reference implementations lost any presumption of safety. The point Cyata CEO Shahar Tal made is the important one: mcp-server-git is the canonical Git MCP server, the code developers copy when building their own. Its vulnerabilities propagate silently into every fork. Anthropic getting it wrong in their reference implementation means the ecosystem inherits the flaw.

The policy-layer controls that break this chain do not depend on the server being clean. The chained exploit requires three tool calls in sequence across two MCP servers: a path-escaping read via Git, a write via Filesystem, and a trigger via another Git call. A deny-by-default cross-server tool policy catches this class of attack at the boundary. Specifically: restrict the Filesystem MCP server from writing to .git directories as a blanket rule; alert on any tool sequence that combines a Git operation with a filesystem write outside the declared project directory; require manual approval for any git_init call pointing outside the configured repository root. None of these require knowing in advance that this specific chain exists.

The broader point is that two MCP servers that each look safe in isolation produce RCE when combined. The policy layer is the only place you see the combination rather than the individual tools.

Mitigations

Update to mcp-server-git version 2025.12.18 or later. The git_init tool has been removed; path validation and argument sanitisation are enforced. If you cannot upgrade immediately, restrict the Filesystem MCP server from writing to any .git directory and prevent the Git MCP server from accepting tool arguments that contain --output, --exec, or path separators in non-path fields. Treat any repository content, including READMEs and issue bodies, as untrusted input that can trigger tool calls.

FAQs

Why does the reference implementation matter more than any other MCP server? +

Because developers building Git integrations copy from it. mcp-server-git is the code Anthropic presents as the example of how a Git MCP server should be built. Its vulnerabilities propagate into every fork that shipped before the December 2025 patch without their authors necessarily knowing they inherited a flaw.

Can this be exploited without compromising the developer's machine directly? +

Yes. The entire chain is triggerable via prompt injection. An attacker who controls any content the AI assistant reads, a README, an issue body, a webpage, can deliver the exploit. No direct network access to the developer's machine is required at any step.

Why was git_init removed rather than patched? +

Anthropic concluded the tool's unrestricted path acceptance was too dangerous to fix incrementally. A tool designed to initialise repositories has no safe behaviour once it accepts arbitrary paths. Removing it was more defensible than attempting to enumerate all the paths that should be disallowed.

References

Take your agents live. Without losing control.

Route your MCP traffic through PolicyLayer. Every tool call is checked against your policy before it runs: allow, deny, or require approval. Per-identity grants. Full audit log. Live in minutes.

TAKE YOUR AGENTS LIVE →

Instant setup, no code required.

46,500+ MCP servers and 515,000+ tools scanned and risk-classified.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.