Argument Injection Vulnerability in git-mcp-server

git-mcp-server version 2.15.1 contains an argument injection vulnerability within the ref and object parameters used by the git_log, git_diff, and git_show tools. The vulnerability arises because these parameters lack proper validation to prevent the inclusion of leading dashes, which are interpreted as command-line flags by the underlying git binary. An attacker who can influence these parameters can inject arbitrary git command-line arguments, such as the --output option. By controlling the output path, an attacker can coerce the process into writing files to unauthorized locations on the filesystem, provided those paths are accessible by the service account running the git-mcp-server process. This vulnerability (CVE-2026-85626) poses a significant risk for unauthorized file creation or overwriting, potentially leading to remote code execution or privilege escalation if sensitive configuration files or startup scripts are targeted.

Impact

Successful exploitation of this vulnerability allows an unauthenticated or authenticated user with access to the MCP interface to perform arbitrary file writes. This can result in system compromise, data destruction, or the injection of malicious scripts that gain execution context under the user account running the git-mcp-server instance.

Recommendation

• Upgrade to a version of git-mcp-server that addresses CVE-2026-85626, as no specific version is identified as patched in the current report, monitor vendor security advisories for the remediation release.
• Implement strict input validation on the backend for all ref and object parameters to ensure they do not start with a dash character.
• Run the git-mcp-server process with the least privilege necessary, restricting write access to the filesystem to only required directories.
• Monitor process execution logs for instances where git child processes are spawned with unexpected command-line arguments, specifically the --output parameter.