Argument Injection Vulnerability in git-mcp-server by Cyanheads

CVE-2026-85626

What is CVE-2026-85626?

The git-mcp-server version 2.15.1 is susceptible to an argument injection vulnerability due to inadequate validation of leading-dash characters in the ref and object parameters used in the git_log, git_diff, and git_show commands. This inadequacy allows attackers to inject custom git command-line options, such as --output=, potentially enabling them to write files to arbitrary paths outside the repository. Such a security flaw poses significant risks, including unauthorized file access and manipulation within systems that utilize this version.

References