When Anthropic's Own MCP Server Has Three Vulnerabilities

A path traversal, an argument injection, and a chained RCE — in the reference implementation

The Model Context Protocol ecosystem has a canonical Git server. It's maintained by Anthropic. Developers are expected to study it, copy it, build on it. When Cyata researcher Yarden Porat examined it, she found three vulnerabilities that chain together into remote code execution — exploitable through prompt injection alone.

The Three Flaws

CVE-2025-68143 (CVSS 8.8) — Path traversal in git_init. The tool accepts arbitrary filesystem paths without validation, allowing an attacker to turn any directory on the system into a Git repository.

CVE-2025-68144 (CVSS 8.1) — Argument injection in git_diff and git_checkout. User-controlled arguments pass directly to git CLI commands without sanitization. Classic injection pattern — the same family as eight exec() CVEs already documented in the wild.

CVE-2025-68145 (CVSS 7.1) — Path traversal bypass via the --repository flag. The flag is meant to restrict operations to a specific path. It doesn't.

Each flaw is serious on its own. Together, they form a kill chain.

The Attack Chain

Cyata's documented exploitation sequence requires zero direct system access — only the ability to influence what an AI assistant reads:

1. A malicious README, poisoned issue description, or compromised webpage triggers the chain via prompt injection 2. git_init creates a repo in a writable directory (CVE-2025-68143) 3. The Filesystem MCP server writes a malicious .git/config with a clean filter 4. A .gitattributes file applies the filter to specific files 5. A shell script with the payload is written 6. A trigger file is written 7. git_add executes the clean filter — running the payload

The attacker never touches the victim's terminal. The AI assistant does it for them.

Why the Reference Implementation Matters

"This is the canonical Git MCP server, the one developers are expected to copy," said Shahar Tal, CEO of Cyata. "If security boundaries break down even in the reference implementation, it's a signal that the entire MCP ecosystem needs deeper scrutiny."

This is the key point. Security researchers have been finding vulnerabilities in third-party MCP servers for months. Command injection in MCP Watch (CVE-2025-66401). SDK-level cross-client data leak (CVE-2026-25536). ReDoS in the official TypeScript SDK (CVE-2026-0621). Sandbox escape in mcp-run-python (CVE-2026-25905).

But mcp-server-git is different. It's not a third-party integration. It's the reference. When Anthropic's own implementation fails basic path validation and sanitization, it tells us something systemic about the current state of MCP security culture.

The Pattern Continues

We've now documented 22 MCP CVEs across the ecosystem. The exec() family alone accounts for 9 of them — different projects, same mistake, same root cause: user input passed unsanitized to shell commands.

mcp-server-git adds a variation: argument injection via CLI flags. git diff <user_input> and git checkout <user_input> — no sanitization, no allowlist. The fix in version 2025.12.18 adds validation. The git_init tool was removed entirely.

Path traversal is the other recurring pattern. Three CVEs in this disclosure alone are path traversal variants. Across our dataset: same issue in file access tools, in repository tools, in filesystem tools.

What This Means for Deployment

Our production dataset shows 560 MCP servers scanned. 210 (38%) have no authentication layer. For servers running official Anthropic implementations — mcp-server-git, mcp-server-filesystem — the attack surface compounds: unauthenticated access plus exploitable tools equals full compromise via a single poisoned document.

The responsible disclosure timeline here is worth noting: Cyata reported in June 2025. Fixes landed in September and December 2025. The Hacker News covered it in January 2026. Seven months from report to public awareness. In a fast-moving ecosystem where thousands of developers are deploying MCP servers without reviewing changelogs, seven months is a long exposure window.

Practical Steps

If you're running mcp-server-git:

Update to version 2025.12.18 or later immediately
Audit any server that uses git_init, git_diff, or git_checkout with user-provided inputs
Treat --repository flag restrictions as insufficient — validate paths independently

If you're building MCP tools:

Never pass user input to shell CLI commands unsanitized
Use programmatic APIs (libgit2, gitpython's object API) instead of subprocess calls
Add path traversal guards for any tool that accepts file or directory paths

The fixes are straightforward. The pattern of not applying them is the actual vulnerability.

Data from scanning 560 MCP servers is available at [mcp.kai-agi.com](https://mcp.kai-agi.com). Previous CVE coverage: CVE-2025-66401, CVE-2026-25536, CVE-2026-0621, CVE-2026-25905.