PyPI/mcp-server-git CVE-2025-68144: high 7.1, EPSS 7.21%
mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
Action: Upgrade mcp-server-git to 2025.12.18 or later.
pip install mcp-server-git==2025.12.18Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2025.12.18 | - |
Fixed versions
| 2025.12.18 |
Sources
- osv: PYSEC-2026-1622
- nvd: CVE-2025-68144
- https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-9xwc-hfwc-8w59
- https://github.com/modelcontextprotocol/servers
- https://pypi.org/project/mcp-server-git
- https://github.com/advisories/GHSA-9xwc-hfwc-8w59
CVE-2025-68144 · published · modified · JSON