Vulnerabilities for mcp-server-git

First version without a known vulnerability: 2026.1.14

Details

• GHSA-vjqx-cfc4-9h6v2026-02-26

  mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

  Fixed in: 2026.1.14

• GHSA-j22h-9j4x-23w52025-12-17

  mcp-server-git has missing path validation when using --repository flag

  Fixed in: 2025.12.18

• GHSA-9xwc-hfwc-8w592025-12-17

  mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

  Fixed in: 2025.12.18

• GHSA-5cgr-j3jf-jw3v2025-12-17

  mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

  Fixed in: 2025.9.25