CVE-2025-68145: 
Python vulnerability analysis and mitigation

CVE-2025-68145 is a path traversal vulnerability (CWE-22) in mcp-server-git, the official Git Model Context Protocol (MCP) server maintained by Anthropic/modelcontextprotocol. When the server is started with the --repository flag to restrict git operations to a specific repository path, it failed to validate that repo_path arguments supplied in subsequent tool calls were actually within that configured path, allowing operations on arbitrary repositories accessible to the server process. The vulnerability affects all versions of mcp-server-git prior to 2025.12.18 (pip package). It was disclosed on December 17, 2025, with a patch released the same day. The CVSS v4 base score is 6.4 (Medium), while the CVSS v3.1 base score is 9.1 (Critical) (Github Advisory, MCP Advisory).

The root cause is improper path validation (CWE-22): the --repository flag was intended to sandbox the server to a single repository, but the server did not resolve or verify that caller-supplied repo_path arguments fell within the configured allowed path before executing git operations. An attacker (or a malicious prompt/tool call) could supply an arbitrary filesystem path — including paths outside the intended repository — as the repo_path argument to any git tool call, causing the server to operate on unintended repositories accessible to the server process. The fix resolves both the configured repository path and the requested path (following symlinks) and verifies containment before executing any git operation. The vulnerability is particularly relevant in AI-agent contexts where prompt injection could be used to supply malicious repo_path values (Github Advisory, Cyata Research).

Successful exploitation allows an attacker to read from or write to any git repository accessible to the server process, bypassing the intended repository restriction. This results in high confidentiality impact (unauthorized access to source code, secrets, or configuration stored in other repositories) and high integrity impact (unauthorized modification of repository contents such as commits, branches, or files). Availability is not directly impacted. In AI-agent deployments, this could enable lateral movement across multiple repositories on the same host, exfiltration of sensitive data (e.g., API keys, credentials stored in git history), or tampering with LLM-accessible codebases (Github Advisory, The Hacker News).

No public exploit code or active in-the-wild exploitation has been confirmed for CVE-2025-68145 specifically. The EPSS score is approximately 0.063–0.177% (39th percentile), indicating a low-to-moderate probability of exploitation in the near term (Github Advisory). The vulnerability is not listed in the CISA KEV catalog. However, the issue was reported via HackerOne by researcher yardenporat, and security researchers at Cyata published a technical write-up demonstrating exploitation of related flaws in Anthropic's MCP git server, including this path traversal issue, in January 2026 (Cyata Research). The attack is particularly feasible in prompt-injection scenarios where an LLM agent processes untrusted content that supplies a malicious repo_path.

1. Identify a vulnerable deployment: Locate an instance of mcp-server-git (pip package mcp-server-git < 2025.12.18) started with the --repository /allowed/repo flag, typically integrated with an AI assistant such as Claude Desktop.
2. Craft a malicious tool call: Prepare a git tool call (e.g., git_log, git_read_file, git_commit) with the repo_path argument set to an arbitrary path outside the configured repository, such as /home/user/sensitive-repo or /etc.
3. Deliver via prompt injection or direct API access: In an AI-agent context, embed the malicious tool call instruction in content the LLM will process (e.g., a README, commit message, or web page fetched by the agent). Alternatively, if the MCP server is directly accessible, send the crafted tool call directly.
4. Execute git operations on the target path: The server, lacking path validation, executes the requested git operation against the attacker-specified path, returning repository contents, history, or allowing file modifications.
5. Exfiltrate or tamper: Read sensitive files (source code, .env files, git history containing secrets) or commit malicious changes to the unintended repository (Cyata Research, Github Advisory).

• Logs: MCP server logs showing git tool calls with repo_path values that differ from the configured --repository path; unexpected paths appearing in git operation arguments.
• File System: Evidence of git operations (reads, commits, diffs) on repositories outside the intended sandbox directory; new or modified files in repositories not configured for MCP access.
• Process: The mcp-server-git process executing git commands against filesystem paths outside the configured --repository directory, observable via process monitoring (e.g., auditd, strace, or EDR telemetry).
• Network: In AI-agent deployments, unusual outbound data transfers following MCP tool calls that reference unexpected repository paths, potentially indicating exfiltration of repository contents.

Users should upgrade the mcp-server-git pip package to version 2025.12.18 or later, which adds path validation that resolves both the configured repository and the requested path (following symlinks) and verifies containment before executing any git operation (Github Advisory, MCP Advisory). To upgrade: pip install --upgrade mcp-server-git or uvx mcp-server-git (which will pull the latest version). As a workaround prior to patching, restrict the OS-level filesystem permissions of the server process account so it can only access the intended repository directory, limiting the blast radius of path traversal attempts.

The vulnerability received significant media coverage in January 2026 when security researchers at Cyata published a detailed technical write-up demonstrating exploitation of multiple flaws — including CVE-2025-68145 — in Anthropic's official MCP git server (Cyata Research). Major outlets including The Hacker News, The Register, InfoSecurity Magazine, CSO Online, and TechRadar covered the story, framing it as a broader warning about AI infrastructure security and the risks of prompt injection in MCP-based agentic systems (The Hacker News, The Register). Security researchers and analysts highlighted the case as an example of classic vulnerability classes (path traversal, prompt injection) manifesting in novel AI tooling contexts, with Endor Labs publishing a broader analysis on why MCP infrastructure needs traditional AppSec practices (Endor Labs). The patch was quietly released by Anthropic/modelcontextprotocol on December 17, 2025, before the public research disclosure.