Security advisories

medium2026-02-26

CVE-2026-27735-mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

GHSA-vjqx-cfc4-9h6v

medium2025-12-17

CVE-2025-68145-mcp-server-git has missing path validation when using --repository flag

GHSA-j22h-9j4x-23w5

medium2025-12-17

CVE-2025-68144- mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

GHSA-9xwc-hfwc-8w59

medium2025-12-17

CVE-2025-68143-mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

GHSA-5cgr-j3jf-jw3v

high2025-07-01

CVE-2025-53110-@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix

GHSA-hc55-p739-j48w

high2025-07-01

CVE-2025-53109-@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling

GHSA-q66q-fx2p-7w4m