Anthropic MCP Git Server Vulnerabilities Enable RCE via Prompt Injection

Anthropic MCP Git Server Flaws Enable File Access and Code Execution

Anthropic’s MCP Git server, a Python package for interacting with Git repositories via LLMs, contains three vulnerabilities (CVE-2025-68143, CVE-2025-68144, CVE-2025-68145) that allow attackers to read, delete, and potentially execute code. The most severe, CVE-2025-68143, has a CVSS score of 8.8, illustrating a high-impact risk.

Why This Matters

Current LLM-based tools often rely on direct interaction with file systems and external processes to achieve functionality, creating a significant attack surface. Ideal models assume sanitized inputs, but in practice, prompt injection attacks can bypass these controls, as demonstrated by the ability to chain these vulnerabilities for RCE. The potential scale of impact is substantial, as this is the “canonical” Git MCP server, meaning widespread adoption increases risk.

Key Insights

• CVE-2025-68143 (2025-09-25): Path traversal vulnerability in git_init due to lack of input validation.
• Prompt Injection: Attackers can weaponize vulnerabilities without direct system access by influencing LLM inputs.
• MCP Ecosystem Scrutiny: These vulnerabilities highlight the need for deeper security analysis of the broader MCP ecosystem.

Working Example

# This example demonstrates the vulnerability chain, but should not be used maliciously.
# It's a simplified illustration of the attack described in the Cyata report.

# 1. Create a repo (vulnerable git_init is assumed)
# 2. Write a malicious .git/config file via Filesystem MCP server
# 3. Write a .gitattributes file to apply a "clean" filter
# 4. Write a shell script with a payload
# 5. Write a file that triggers the filter
# 6. Call git_add, executing the payload

Practical Applications

• Developer Workflow: Companies using Anthropic’s MCP Git server in CI/CD pipelines are vulnerable to code injection.
• Pitfall: Trusting user-controlled input directly within Git commands without sanitization can lead to arbitrary code execution.

References:

• https://thehackernews.com/2026/01/three-flaws-in-anthropic-mcp-git-server.html