Description

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths accessible by the process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T15:17:43.040Z",
  "pubdate": "2026-09-04T15:17:43.040Z",
  "executiveSummary": "The git-mcp-server application, specifically version 2.15.1, is susceptible to an argument injection vulnerability residing in its handling of Git repository parameters. This flaw exists within the git_log, git_diff, and git_show tools.\nThe root cause is a failure to implement proper input sanitization or validation for the ref and object parameters, specifically the lack of checks against leading dashes. This oversight allows an attacker to pass arbitrary command-line flags to the underlying git binary.\nBy injecting malicious arguments such as --output, an attacker can coerce the process into writing data to arbitrary file paths on the host filesystem that the server process has permissions to access.\nThis vulnerability poses a significant risk, potentially leading to unauthorized file writes, data exfiltration, or the overwriting of sensitive configuration files, depending on the environment's permissions. Exploitation requires the ability to interact with the affected tool parameters. There are no authentication requirements specified for the underlying vulnerability, meaning the impact depends on the server's deployment and exposure.",
  "technicalDetails": "The vulnerability is classified as an argument injection flaw originating from improper input handling when invoking the git command-line interface. In git-mcp-server version 2.15.1, the tools git_log, git_diff, and git_show accept user-supplied input for the ref and object parameters. These parameters are subsequently passed directly to the git process as command-line arguments without verifying if the provided strings are prefixed with a dash character (-).\nIn the context of standard command-line utilities, arguments beginning with dashes are interpreted as configuration flags rather than positional arguments. Because the application fails to validate or sanitize these inputs, an attacker can supply flags that the underlying git executable interprets during execution. Specifically, an attacker can inject options like --output=<file_path> or other relevant git-subcommand flags.\nThe attack flow proceeds as follows: 1. The attacker identifies an interaction vector with the git-mcp-server that allows input to be passed to the ref or object parameters of the vulnerable functions. 2. Instead of providing a legitimate Git reference (such as a commit hash or branch name), the attacker supplies a crafted string starting with a dash, for example: --output=/tmp/malicious_file.txt. 3. The server-side code executes the git command, effectively appending the attacker-controlled flag to the command array. 4. The git utility processes the injected flag. In the case of --output, the utility redirects the output stream of the git operation to a location of the attacker's choosing. 5. If the process running git-mcp-server operates with elevated privileges or has write access to sensitive directories, the attacker can use this behavior to create or overwrite arbitrary files.\nThis vulnerability is particularly severe because it bypasses expected repository interaction bounds. By controlling the flags passed to the git process, the attacker may also influence other aspects of execution depending on which Git version and specific flags are supported by the environment. The primary impact is arbitrary file write capability, which can be leveraged for lateral movement, privilege escalation via configuration manipulation, or denial of service by overwriting system binaries or logs. There is no indication that this vulnerability requires authentication, making it a critical concern for any instance of git-mcp-server exposed to untrusted input."
}