git-mcp-server vulnerabilities

2 known vulnerabilities in git-mcp-server from Cyanheads. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  git-mcp-server: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-85626Sep 4, 2026Cyanheads

  git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside

• 7.5 High severity

  git-mcp-server: Improper Neutralization of Special Elements used in a Command

  CVE-2025-53107Jul 1, 2025CyanheadsEPSS 24.5%

  @cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories. Prior to version 2.1.5, there is a command injection vulnerability caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacke