Incident: A repository limit the server never checked

Module 4 · Incident file · About 30 minutes

What happened

mcp-server-git is the reference MCP server for Git, published by the Model Context Protocol project in its modelcontextprotocol/servers repository. It can be started with a --repository flag, which, in the words of the project's advisory, is meant "to restrict operations to a specific repository path". Every tool call also names the repository it works on, in an argument called repo_path.

On 17 December 2025 the project published advisory GHSA-j22h-9j4x-23w5, CVE-2025-68145, "Missing path validation when using --repository flag in mcp-server-git" (advisory). Before version 2025.12.18, the server "did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could allow tool calls to operate on other repositories accessible to the server process." The advisory rates it medium (CVSS 4.0 score 6.4), thanks a researcher reporting through HackerOne, and tells users to upgrade to 2025.12.18.

On 20 January 2026 The Register reported the fix (Jessica Lyons, The Register). It names the finder as Cyata, an agentic AI security start-up, and its researcher Yarden Porat, and says Cyata reported this and two other flaws (CVE-2025-68143 in git_init, which was removed, and CVE-2025-68144, an argument injection) to Anthropic in June 2025, and that they were fixed in December. Porat told the paper there was no indication that attackers exploited the bugs in the wild, and the paper says Anthropic did not respond to its inquiries. The cost on record is the exposure: about six months between report and fix, during which a server started with a limit did not enforce it. The article also describes a chained attack with a second server; this file stays with the one flaw the advisory documents.