CVE-2026-85626: git-mcp-server Path Traversal Vulnerability

CVE-2026-85626 Overview

CVE-2026-85626 is an argument injection vulnerability in git-mcp-server version 2.15.1. The flaw affects the ref and object parameters of the git_log, git_diff, and git_show tools. These parameters lack leading-dash validation, allowing attackers to inject git command-line options such as --output= to write files outside the repository to arbitrary paths accessible by the process. The weakness is tracked as CWE-88: Argument Injection.

Critical Impact
Remote attackers without authentication can write arbitrary files to any location writable by the git-mcp-server process, enabling code execution and integrity compromise across the host.

Affected Products

git-mcp-server version 2.15.1
Model Context Protocol (MCP) integrations that expose git tools via git-mcp-server
Deployments consuming untrusted ref or object parameters through MCP clients

Discovery Timeline

2026-09-04 - CVE-2026-85626 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85626

Vulnerability Analysis

The git-mcp-server project exposes git operations to Model Context Protocol clients. Versions at 2.15.1 pass user-controlled ref and object parameters directly to the git command line without rejecting values beginning with a dash. Git interprets any dash-prefixed token as a command-line option rather than a reference. An attacker can therefore convert a data field into a flag such as --output=/path/to/file, which redirects git output to attacker-chosen locations. The impact is scoped to integrity in the CVSS 4.0 vector, but writing controlled content to executable paths, cron directories, or SSH configuration files can escalate into full remote code execution. Additional context is available in the VulnCheck Security Advisory.

Root Cause

The root cause is missing input validation in the CLI command construction path. The log.ts, diff, and show operations forward ref and object values into argument arrays without checking for a leading - character. Git treats such tokens as options, breaking the boundary between data and command flags. Review of the fixed code is available in the GitHub Commit Log Implementation and the GitHub Command Builder Utility.

Attack Vector

Exploitation requires only network access to the MCP server and the ability to invoke git_log, git_diff, or git_show. An attacker submits a crafted ref or object value such as --output=/etc/cron.d/backdoor alongside a payload that git renders into that file. No authentication or user interaction is required. Because MCP servers frequently run alongside AI agents that automatically relay untrusted external content into tool calls, indirect prompt injection can trigger the flaw without a direct attacker session. See the GitHub Issue #53 Discussion for reproduction context.

No verified public exploit code is available. The vulnerability mechanism is described in prose above; refer to the linked advisory for reproduction details.

Detection Methods for CVE-2026-85626

Indicators of Compromise

Process telemetry showing git log, git diff, or git show invocations with arguments beginning with --output=, --upload-pack=, or other option-style tokens where a ref is expected
Unexpected new files under paths writable by the MCP service account, particularly in /etc/cron.*, ~/.ssh/, or web-served directories
MCP request logs containing ref or object field values beginning with - or --
Outbound git operations referencing suspicious hostnames or local file paths

Detection Strategies

Inspect MCP server access logs for tool calls whose ref or object parameters start with a dash character
Correlate git-mcp-server process launches with unexpected child file writes outside the working repository
Baseline normal git argument patterns and alert on flags such as --output, --upload-pack, --receive-pack, or --exec appearing in ref positions

Monitoring Recommendations

Enable command-line argument capture for the git binary on hosts running git-mcp-server
Forward MCP server request and response bodies to a centralized log store for retrospective search
Monitor filesystem integrity on directories writable by the MCP service account

How to Mitigate CVE-2026-85626

Immediate Actions Required

Upgrade git-mcp-server to version 2.15.3 or later, which enforces leading-dash validation on ref and object parameters
Restrict network exposure of the MCP server to trusted clients only and place it behind authenticated transport
Run the MCP server under a least-privilege service account with no write access to sensitive system directories
Audit MCP tool call history for any prior invocations containing dash-prefixed ref or object values

Patch Information

The maintainer released a fix in git-mcp-server version 2.15.3. The patched code paths in log.ts and command-builder.ts add validation that rejects arguments starting with -. Review the fix at the GitHub Repository for Git MCP Server and the VulnCheck Security Advisory.

Workarounds

If upgrading is not immediately possible, place a reverse proxy or MCP gateway in front of the server that rejects any ref or object field beginning with -
Disable the git_log, git_diff, and git_show tools in MCP server configuration until patching is complete
Chroot or containerize the MCP process so that arbitrary file writes cannot reach host-sensitive paths

bash

# Configuration example: reject dash-prefixed ref values at a proxy layer
# Example nginx snippet blocking suspicious MCP payloads
location /mcp/ {
    if ($request_body ~* "\"(ref|object)\"\s*:\s*\"-") {
        return 400;
    }
    proxy_pass http://git_mcp_backend;
}