CVE-2025-53107

@cyanheads/git-mcp-server before 2.1.5 constructs shell commands for Git operations by embedding unvalidated input directly into command-line strings passed to child_process.exec, enabling shell metacharacter injection (|, >, &&) that runs arbitrary system commands (CWE-77). An attacker does not need direct network access to the server: an MCP client can be manipulated, for example via indirect prompt injection planted in repository content such as git logs that the client is asked to read, into supplying malicious parameters. Successful exploitation yields remote code execution with the privileges of the MCP server process. Anyone running @cyanheads/git-mcp-server prior to 2.1.5 alongside an MCP client with access to Git repositories is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, but EPSS assigns a high 27.5% probability of exploitation within 30 days (98th percentile), and the CVSS 3.1 base score is 7.5 (high).

What to do: Upgrade @cyanheads/git-mcp-server to 2.1.5 or later. Until upgraded, minimize the MCP server process's system privileges and treat repository-derived text (commit messages, branch names, git log output) as untrusted, since indirect prompt injection can drive the command injection. Review logs and process activity on developer machines running the server for unexpected commands executed under the server's user.