Anthropic Fixes Critical Remote Code Execution Flaws in Git MCP Server
- Securityish
- Threats & Incidents
Quick Summary
Anthropic has addressed three vulnerabilities in its Git MCP server that allowed for remote code execution and file overwriting via prompt injection. Discovered by Cyata, these flaws were reported in June 2025 and fixed by December 18, 2025. The vulnerabilities, identified as CVE-2025-68143, CVE-2025-68144, and CVE-2025-68145, affect default deployments prior to the fix, highlighting the risks associated with complex AI systems integrating multiple tools.
The Securityish Brief
Anthropic has recently resolved three significant vulnerabilities in its Git MCP server, known as mcp-server-git, which connects AI tools like Copilot, Claude, and Cursor to Git repositories. These vulnerabilities, discovered by Cyata, included a path validation bypass (CVE-2025-68145), an unrestricted git_init issue (CVE-2025-68143), and an argument injection in git_diff (CVE-2025-68144). Reported in June 2025, these flaws were fixed by December 18, 2025, affecting default deployments prior to this date.
The vulnerabilities allowed attackers to exploit the Git MCP server in conjunction with the Filesystem MCP server to execute malicious code. Specifically, the attack chain involved creating a Git repository, writing a payload script, modifying Git’s internal configuration files, and triggering the execution of the script through Git’s clean and smudge filters. Cyata’s research indicates that while there is no evidence of these vulnerabilities being exploited in the wild, the potential for such attacks underscores the need for robust security measures.
Understanding the Vulnerabilities
The first vulnerability, CVE-2025-68145, allowed attackers to bypass repository path restrictions, granting access to any repository on the system. CVE-2025-68143 enabled the creation of Git repositories without validation, while CVE-2025-68144 permitted the injection of user-controlled arguments directly into the GitPython library, leading to file overwrites. These flaws illustrate how interconnected AI systems can create unforeseen security risks when combined.
As organizations increasingly adopt complex agentic systems, the risks associated with these vulnerabilities will likely grow. Security teams must evaluate the permissions of entire systems rather than individual components, as the integration of multiple tools can expand the attack surface significantly. Trust in these systems should be verified and controlled, rather than assumed.
Key Takeaways
- Ensure your deployment of the mcp-server-git is updated to the version released after December 18, 2025.
- Review and restrict permissions for all AI tools and integrations within your organization.
- Monitor for any unusual activities that may indicate exploitation attempts of interconnected systems.
- Implement regular security assessments to evaluate the vulnerabilities of agentic systems.
- Educate your team on the risks associated with prompt injection and how to mitigate them.
Key Terms & Concepts
- CVE-2025-68143: This CVE refers to an unrestricted git_init issue that allowed arbitrary filesystem paths to be accepted without validation.
- CVE-2025-68144: This CVE identifies an argument injection vulnerability in git_diff that permitted user-controlled arguments to be passed directly to the GitPython library.
- CVE-2025-68145: This CVE describes a path validation bypass flaw that allowed attackers to access repositories outside of the intended path.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2026/01/20/anthropic_prompt_injection_flaws/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
