High severity · published Dec 17, 2025
CVE-2025-68143
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
8.8
CVSS
8.1%
EPSS
No
On KEV
Description
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, git_init could operate on any directory accessible to the server process, making those directories eligible for subsequent git operations. The tool was removed entirely, as the server is intended to operate on existing repositories only. Users are advised to upgrade to 2025.9.25 or newer to remediate this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.1% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
servers · modelcontextprotocol
< 2025.9.25 · source: vendor
MC
Model Context Protocol Servers · Lfprojects
before 2025.9.25 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-68143
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-68143
Patch
https://github.com/modelcontextprotocol/servers/commit/eac56e7bcde48fb64d5a973924d05d69a7d876e6
Vendor Advisory
https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-5cgr-j3jf-jw3v
More from servers
9.1
CVE-2025-68145
mcp-server-git has missing path validation when using --repository flag
7.1
CVE-2025-68144
mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
6.5
CVE-2026-27735
mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
