PyPI/mcp-server-git CVE-2026-27735: medium 6.5, EPSS 0.34%

mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

Action: Upgrade mcp-server-git to 2026.1.14 or later.

pip install mcp-server-git==2026.1.14

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2630
• nvd: CVE-2026-27735
• https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-vjqx-cfc4-9h6v
• https://github.com/modelcontextprotocol/servers/pull/3164
• https://github.com/modelcontextprotocol/servers/commit/862e717ff714987bd5577318df09858e14883863
• https://github.com/modelcontextprotocol/servers
• https://pypi.org/project/mcp-server-git
• https://github.com/advisories/GHSA-vjqx-cfc4-9h6v

CVE-2026-27735 · published 2026-07-13T14:36:39.269283Z · modified 2026-07-13T16:32:13.804937383Z · JSON