CVE-2025-68143/68144/68145: three flaws in the reference Git MCP server

What happened

• According to GitHub Advisory Database's advisory (Dec 17, 2025), git_init accepted arbitrary filesystem paths and created repositories without validating the location. [1]
• git_diff and git_checkout passed user-controlled arguments to git, so flag-like values such as --output= could overwrite arbitrary files. [2]
• With --repository set, repo_path in later tool calls was not checked to be inside that repository. [3]

Impact

• Arbitrary file overwrites and git operations on repositories outside the one the server was meant to be limited to. [2][3]

What was done

• git_init was removed in 2025.9.25; argument and path validation was added in 2025.12.18. [1][2][3]

How to protect yourself

• Upgrade mcp-server-git to 2025.12.18 or later. [2][3]

Sources

1. GHSA-5cgr-j3jf-jw3v (CVE-2025-68143) — GitHub Advisory Database
2. GHSA-9xwc-hfwc-8w59 (CVE-2025-68144) — GitHub Advisory Database
3. GHSA-j22h-9j4x-23w5 (CVE-2025-68145) — GitHub Advisory Database

Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.