CVE-2025-68144: 
Python vulnerability analysis and mitigation

CVE-2025-68144 is an argument injection vulnerability in the mcp-server-git package (part of Anthropic's official Model Context Protocol reference server implementations) that allows arbitrary file overwrites on the host system. The git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization, enabling flag-like values (e.g., --output=/path/to/file) to be interpreted as command-line options rather than git refs. All versions prior to 2025.12.18 are affected. The vulnerability was disclosed on December 17, 2025, with a CVSS v3.1 score of 7.1 (High) and a CVSS v4.0 score of 6.3 (Medium) (Github Advisory, GitHub Security Advisory).

The root cause is CWE-88 (Improper Neutralization of Argument Delimiters in a Command — Argument Injection). The git_diff and git_checkout functions in mcp-server-git constructed git CLI invocations by directly interpolating user-supplied arguments without validating whether they began with a - character (flag prefix). An attacker could supply a value such as --output=/etc/cron.d/backdoor to git_diff, causing git to interpret it as a command-line flag and write output to an arbitrary path rather than treating it as a git ref. The fix introduced two controls: rejection of any argument starting with -, and verification that the argument resolves to a valid git ref via git rev-parse before execution (Github Advisory, GitHub Security Advisory).

Successful exploitation allows an attacker to overwrite arbitrary files on the system running the MCP server, with the permissions of the process executing the git commands. This can lead to integrity compromise of critical system files, configuration tampering, or planting of malicious scripts (e.g., cron jobs, SSH authorized keys) that enable persistent access or code execution. While confidentiality impact is rated as none (no direct data exfiltration), the ability to overwrite files creates a pathway for privilege escalation and lateral movement within the host environment. Availability is also partially impacted if critical files are corrupted (Github Advisory, Cyata Research).

No public exploit code or active in-the-wild exploitation has been confirmed for CVE-2025-68144. The EPSS score is approximately 0.015% (3rd percentile), indicating a low near-term exploitation probability. The vulnerability requires passive user interaction (an LLM or user must invoke the vulnerable git_diff or git_checkout tool with attacker-controlled input), which can be achieved via prompt injection attacks against AI agents using the MCP server. The vulnerability is not listed in the CISA KEV catalog. The bug was responsibly disclosed via HackerOne by researcher yardenporat (Github Advisory, The Hacker News).

1. Identify target: Locate an AI agent or LLM-powered application (e.g., Claude Desktop) that uses mcp-server-git version prior to 2025.12.18 and exposes the git_diff or git_checkout tools.
2. Craft prompt injection payload: Inject a malicious instruction into content that the LLM will process — for example, embed a hidden instruction in a git commit message, README, or repository file that instructs the AI to call git_diff with a flag-like argument.
3. Trigger the vulnerable function: The injected prompt causes the LLM to invoke git_diff with an argument such as --output=/home/user/.ssh/authorized_keys or git_checkout with --orphan combined with a target path, bypassing the intended git ref handling.
4. Achieve file overwrite: The git CLI interprets the injected flag as a command-line option, writing controlled content (e.g., diff output or repository content) to the specified arbitrary file path on the host system.
5. Establish persistence or escalate: Use the overwritten file (e.g., SSH authorized_keys, cron job, shell profile) to gain persistent access or execute code under the server process's user account (Github Advisory, Cyata Research, The Hacker News).

• Logs: MCP server logs showing calls to git_diff or git_checkout with arguments beginning with -- (flag-like patterns) rather than valid git refs; unexpected git rev-parse failures followed by git command execution.
• File System: Unexpected modification timestamps on sensitive files (e.g., ~/.ssh/authorized_keys, /etc/cron.d/*, shell profile files like ~/.bashrc or ~/.profile); new or modified files in locations not normally written by git operations.
• Process: Unusual git diff or git checkout subprocess invocations with --output= or other flag arguments visible in process listings (e.g., via ps aux or audit logs); git processes writing to paths outside the repository directory.
• Network: Outbound connections from the MCP server host to unexpected external IPs following git tool invocations, potentially indicating post-exploitation activity.

Users should upgrade mcp-server-git to version 2025.12.18 or later, which adds input validation rejecting arguments starting with - and verifies arguments resolve to valid git refs via git rev-parse before execution. No official workaround is provided for users unable to upgrade immediately; as a temporary measure, restrict the MCP server's access to sensitive file paths using OS-level controls (e.g., running the server as a low-privilege user with limited write permissions). Organizations using AI agents with MCP integrations should also audit prompt injection risks in content processed by LLMs that invoke git tools (Github Advisory, GitHub Security Advisory).

The vulnerability received significant media coverage in January 2026 when Cyata Research published a detailed technical blog post titled "Breaking Anthropic's Official MCP Server," which prompted broader reporting from The Hacker News, The Register, InfoSecurity Magazine, CSO Online, and TechRadar (The Hacker News, The Register, Cyata Research). Coverage framed the issue as part of a broader set of three vulnerabilities in Anthropic's official git MCP server, highlighting the risks of prompt injection enabling exploitation of argument injection flaws in AI-integrated tooling. Security researchers and community commentators noted that the vulnerability exemplifies how classic injection weaknesses resurface in AI/LLM infrastructure, with Endor Labs publishing an analysis titled "Classic Vulnerabilities Meet AI Infrastructure" (Endor Labs). The incident contributed to broader industry discussion about the security maturity of MCP server implementations.