Skip to content
OpenAdvisories

Product · cyanheads

git-mcp-server

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-85626

    git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters

    git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside…

    cyanheads git-mcp-server
  • High 7.5
    CVE-2025-53107 EPSS 25%

    @cyanheads/git-mcp-server vulnerable to command injection in several tools

    @cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories. Prior to version 2.1.5, there is a command injection vulnerability caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attack…

    cyanheads git-mcp-server @cyanheads/git-mcp-server npm