CVE-2026-85626 — git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters
git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. A…
Published: 2026-09-04 · CVSS: 8.7 · CVSS 4.0
git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths accessible by the process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7