CVE-2025-68143: 
Python vulnerability analysis and mitigation

CVE-2025-68143 is an absolute path traversal vulnerability in the mcp-server-git package (the official Model Context Protocol Git server maintained by Anthropic) that allows repository creation at arbitrary filesystem locations. In versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths without validating the target location, unlike other tools in the server which required an existing repository. The vulnerability was disclosed on December 17, 2025, and affects all mcp-server-git (pip) versions before 2025.9.25. It carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 6.5 (Medium) (GitHub Advisory, MCP Servers Advisory).

The root cause is CWE-22/CWE-36 (Absolute Path Traversal): the git_init tool in server.py called git.Repo.init(path=repo_path, mkdir=True) using attacker-supplied input without any path validation or restriction to a permitted directory. Because git_init was uniquely exempt from the requirement for a pre-existing repository, it could be invoked against any directory accessible to the server process — including sensitive system directories. Once a directory was initialized as a Git repository, it became eligible for all subsequent git operations exposed by the MCP server (e.g., git_status, git_log, git_diff), potentially enabling file content disclosure or manipulation. The fix, contributed by @0dd, removed the git_init tool entirely from the server (MCP Servers Commit, GitHub Advisory).

Successful exploitation allows an attacker to initialize Git repositories in arbitrary filesystem locations accessible to the server process, then leverage other git tools exposed by the MCP server to read sensitive files, exfiltrate data, or tamper with directory contents. The CVSS v4.0 subsequent system impact metrics rate confidentiality, integrity, and availability as High, reflecting that downstream systems (e.g., the host OS, application data directories) can be fully compromised. In AI-integrated environments where the MCP server operates with broad filesystem access, this could enable lateral movement, credential theft, or LLM context poisoning (GitHub Advisory, Cyata Research).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-68143. The EPSS score is approximately 0.034% (10th percentile), indicating a low near-term exploitation probability. The vulnerability was responsibly disclosed via HackerOne by researcher yardenporat and is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires passive user interaction (an MCP client session must be active), but no privileges or authentication are needed from the attacker's perspective (GitHub Advisory).

1. Identify target: Locate a deployment of mcp-server-git (pip) running a version prior to 2025.9.25, typically integrated with an AI assistant such as Claude Desktop.
2. Establish MCP session: Interact with the MCP server through a connected client (e.g., Claude Desktop or a custom MCP client), which provides access to the server's exposed tools.
3. Invoke git_init with arbitrary path: Call the git_init tool with a crafted repo_path argument pointing to a sensitive directory (e.g., /etc, /home/user/.ssh, or an application config directory) that the server process has access to.
4. Initialize repository: The server executes git.Repo.init(path=<attacker_path>, mkdir=True) without validation, creating a .git directory at the specified location.
5. Leverage subsequent git operations: Use other MCP git tools (e.g., git_status, git_log, git_diff, git_show) against the newly initialized path to read file contents, enumerate directory structure, or stage/commit changes — effectively gaining read/write access to arbitrary filesystem locations (GitHub Advisory, MCP Servers Commit).

• File System: Unexpected .git directories created in non-repository locations such as /etc/, /home/<user>/, /tmp/, or application configuration directories; presence of .git/config, .git/HEAD files in sensitive paths.
• Logs: MCP server logs showing git_init tool invocations with unusual or absolute path arguments (e.g., paths outside expected repository directories); repeated calls to git tools (git_status, git_diff) against newly initialized paths.
• Process: Server process (mcp_server_git / Python) spawning git init subprocesses targeting directories outside normal working paths; unexpected file access patterns by the MCP server process user.

The git_init tool has been removed entirely in mcp-server-git version 2025.9.25. Users should upgrade immediately using pip install --upgrade mcp-server-git or uvx mcp-server-git (which will pull the latest version). No configuration-based workaround exists for older versions since the vulnerable tool cannot be selectively disabled without code changes. As a defense-in-depth measure, restrict the OS-level permissions of the account running mcp-server-git to limit filesystem access to only required repository directories (GitHub Advisory, MCP Servers Commit).

The vulnerability received notable media coverage in January 2026 when security researcher Cyata published a detailed analysis of multiple flaws in Anthropic's official MCP Git server, prompting broader reporting by The Hacker News, The Register, Infosecurity Magazine, CSO Online, and TechRadar (The Hacker News, The Register, Cyata Research). Security Boulevard and Endor Labs used the disclosure to highlight broader MCP ecosystem security risks, noting that classic vulnerability classes like path traversal are now appearing in AI infrastructure (Security Boulevard, Endor Labs). Community discussion on Reddit and LinkedIn reflected concern that Anthropic's own reference implementations — intended as security examples — contained exploitable flaws, with some researchers calling for stronger security review of MCP servers before publication.