CVE-2025-68144 Overview
CVE-2025-68144 is an argument injection vulnerability [CWE-88] in mcp-server-git, a reference Model Context Protocol (MCP) server maintained under the modelcontextprotocol/servers repository. Versions prior to 2025.12.17 pass user-controlled arguments directly to the git command-line interface without sanitization. An attacker can supply flag-like values such as --output=/path/to/file to the git_diff and git_checkout functions. The git binary interprets these as command-line options rather than refs, enabling arbitrary file overwrites on the host running the MCP server.
Critical Impact
Attackers who can influence MCP tool inputs can overwrite arbitrary files on the server host by abusing unvalidated arguments passed to git_diff and git_checkout.
Affected Products
- modelcontextprotocol/servers — mcp-server-git component
- All mcp-server-git releases prior to 2025.12.17
- Deployments exposing git_diff or git_checkout MCP tools to untrusted input
Discovery Timeline
- 2025-12-17 - CVE-2025-68144 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-68144
Vulnerability Analysis
The MCP server exposes git_diff and git_checkout as callable tools. Each tool forwards its arguments into a git subprocess invocation. Because the server does not validate whether an argument begins with -, the underlying git CLI treats any such value as an option flag. For git diff, the --output=<path> flag writes diff output to an attacker-chosen path, producing an arbitrary file write primitive. The same class of injection extends to other git-supported flags reachable via the vulnerable functions.
The issue carries an EPSS probability of 7.406% (93.792 percentile), indicating elevated relative likelihood of exploitation attempts against exposed instances.
Root Cause
The root cause is missing input validation on positional arguments that are semantically intended to be git refs. The server treats the arguments as opaque strings and hands them to git without asserting they are refs. git itself does not distinguish attacker-controlled positional data from operator-supplied flags, so any string starting with - becomes an option. This is the classic argument injection pattern documented in CWE-88.
Attack Vector
Exploitation requires an attacker to influence the arguments delivered to git_diff or git_checkout. In MCP deployments, this typically occurs when an LLM agent is prompted, directly or through indirect prompt injection, to invoke these tools with attacker-controlled values. Passing --output=/absolute/path to git_diff causes git to write diff output to that path, overwriting existing files with the privileges of the MCP server process. No authentication to git itself is required beyond what the server already grants.
See the GitHub Security Advisory GHSA-9xwc-hfwc-8w59 for the maintainer's technical description.
Detection Methods for CVE-2025-68144
Indicators of Compromise
- Unexpected files written by the user account running mcp-server-git, especially outside repository working directories.
- git process invocations containing arguments starting with --output=, --upload-pack=, or other flags in positions expected to be refs.
- MCP tool-call logs showing git_diff or git_checkout invoked with arguments beginning with -.
Detection Strategies
- Inspect MCP server audit logs for tool calls whose ref arguments begin with - or contain =.
- Instrument the host to capture git command lines via process auditing (auditdexecve rules on Linux) and alert on flag-like positional arguments.
- Correlate file-write telemetry with the parent git process to identify writes outside expected repository paths.
Monitoring Recommendations
- Enable verbose logging in mcp-server-git and forward tool-invocation events to a central log store.
- Monitor filesystem integrity on directories writable by the MCP service account.
- Track outbound child processes from the MCP server and alert on unexpected git argument patterns.
How to Mitigate CVE-2025-68144
Immediate Actions Required
- Upgrade mcp-server-git to version 2025.12.17 or later, which validates arguments and rejects values starting with -.
- Restrict which principals can invoke git_diff and git_checkout through the MCP server.
- Run the MCP server under a least-privileged account with no write access to sensitive paths.
Patch Information
The fix in 2025.12.17 rejects arguments beginning with - and verifies each argument resolves to a valid git ref via git rev-parse before executing the underlying command. Full details are documented in the GitHub Security Advisory GHSA-9xwc-hfwc-8w59.
Workarounds
- Disable the git_diff and git_checkout tools in the MCP server configuration until the patched version is deployed.
- Front the MCP server with a validation layer that rejects any argument beginning with - or containing = before forwarding calls.
- Confine the server with mandatory access controls (AppArmor, SELinux) or a container filesystem policy that blocks writes outside the repository directory.
# Upgrade the vulnerable component
pip install --upgrade 'mcp-server-git>=2025.12.17'
# Verify the installed version
pip show mcp-server-git | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
