Anthropic MCP Git Server Vulnerabilities Enable File Access and Code Execution

Anthropic’s MCP Git server, known as mcp-server-git, has been found to contain three significant vulnerabilities that could be exploited to read or delete arbitrary files and execute code. These vulnerabilities were disclosed in June 2025 and have been addressed in subsequent software updates. The specific vulnerabilities are CVE-2025-68143, CVE-2025-68144, and CVE-2025-68145, with CVSS scores indicating their severity.

CVE-2025-68143 is a path traversal vulnerability linked to the git_init tool, which accepted arbitrary file system paths without validation. CVE-2025-68144 involves argument injection due to the git_diff and git_checkout functions passing user-controlled arguments directly to git CLI commands. Lastly, CVE-2025-68145 is another path traversal vulnerability resulting from missing path validation when using the –repository flag.

Successful exploitation of these vulnerabilities could allow an attacker to manipulate any directory on the system, turning it into a Git repository, overwriting files, and accessing repositories on the server. A documented attack scenario illustrates how these vulnerabilities can be chained with the Filesystem MCP server to achieve remote code execution.

In response to these findings, the git_init tool has been removed from the package, and additional validation measures have been implemented to prevent path traversal issues. Users are strongly advised to update to the latest versions of the software to ensure their systems are protected.

Implications for Users and Organizations

This incident highlights the critical need for vigilance in software security, particularly in widely used tools like the MCP Git server. The vulnerabilities not only expose individual users but also pose risks to organizations relying on this technology for their operations.

As the MCP Git server is a reference implementation, security flaws in such foundational software can indicate broader vulnerabilities within the ecosystem. Organizations should consider reviewing their use of similar technologies and implementing stricter security measures.

Users should monitor for updates and ensure they are using the latest versions of software to mitigate risks associated with known vulnerabilities. Regularly auditing configurations and access controls can also help reduce the potential attack surface.