CVE-2026-85626

git-mcp-server 2.15.1 contains an argument injection flaw (CWE-88) because the ref and object parameters of its git_log, git_diff, and git_show tools are passed to the underlying git command without validating that they do not begin with a dash. An attacker who can influence these tool arguments — typically through an agent or client invoking the MCP tools with untrusted values — can inject git command-line options such as --output=<path>. This causes git to write command output to an arbitrary file path accessible by the server process, allowing modification or overwrite of files outside the repository (integrity impact only; CVSS 4.0 scores it 8.7 High with VI:H and no confidentiality or availability impact). Anyone running git-mcp-server 2.15.1 in an AI agent or LLM toolchain where tool arguments can be shaped by untrusted input is affected. Exploitation has not been observed: there is no known public proof-of-concept, it is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Update git-mcp-server to a release that adds leading-dash validation for the ref and object parameters as soon as a patched version is published. As interim mitigation, restrict the server process's filesystem write permissions and run it in a sandbox or least-privilege container, and limit which agents or clients may invoke git_log, git_diff, and git_show with untrusted input. Audit hosts running the server for unexpected or modified files outside repository directories that could indicate --output-based writes.