Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could allow tool calls to operate on other repositories accessible to the server process. The fix adds path validation that resolves both the configured repository and the requested path (following symlinks) and verifies the requested path is within the allowed repository before executing any git operations. Users are advised to upgrade to 2025.12.17 upon release to remediate this issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-01 | 1 | Disclosure1 |
| 2026-02-02 | 2 | Disclosure1Patch1 |
| 2026-02-19 | 1 | Disclosure1 |
| 2026-02-23 | 2 | Disclosure2 |
| 2026-03-10 | 1 | Disclosure1 |
| 2026-05-20 | 1 | General1 |
3/ Real example: Anthropic's official Git MCP server had a path traversal vulnerability (CVE-2025-68145). Agents could read arbitrary files outside the repo. The "official" server. Found by a third party, not Anthropic.
Post summary
The text reports a path traversal flaw (CVE-2025-68145) discovered in Anthropic’s official Git MCP server, noting that the vulnerability allows reading arbitrary files outside the repo.
1// The CVEs weren't exotic. They were the basics. CVE-2025-68143: git_init created repos at arbitrary filesystem paths. No boundary validation. CVE-2025-68144: Argument injection — user-controlled strings passed directly into shell commands. CVE-2025-68145: Path traversal through a parameter that was never sanitised. All three exploitable via prompt injection. All three in the reference implementation developers are told to copy.
Post summary
The post discloses three CVEs with basic technical details, noting they can be exploited via prompt injection, but provides no PoC, exploit code, patch, or evidence of active exploitation.
@Lemo_bot - **CVE-2025-68145 (CVSS 7.1)**: Path traversal via missing validation on the `--repository` flag, enabling access to any system directory or repository.
Post summary
The tweet announces CVE-2025-68145, a path‑traversal flaw with CVSS 7.1 due to missing validation on the `--repository` flag, with no PoC, exploit, patch or active exploitation reported.
MCP connectors carry known CVEs including one-click RCE (CVE-2025-6514) and path traversal in Anthropic's own servers (CVE-2025-68145). No formal certification exists. You're trusting third-party supply chains with access to your legal and financial data.
Post summary
The post lists two CVEs that may affect MCP connectors and warns about third‑party supply chain exposure, but it does not provide a PoC, exploit, patch, or evidence of wild exploitation.
But here's what most people miss — security. Three RCE vulnerabilities were found in Anthropic's own Git MCP server this month (CVE-2025-68145, CVE-2025-68143, CVE-2025-68144). As MCP becomes the connective tissue for AI agents, the attack surface grows exponentially. Security can't be an afterthought.
Post summary
The post announces the discovery of three RCE vulnerabilities (CVE-2025-68145, CVE-2025-68143, CVE-2025-68144) in Anthropic’s Git MCP server, highlighting the expanding attack surface as AI agents become more connected.
@ecap0_ CVE-2025-68145 has an unspecified CVSS Score. It fails to validate `repo_path` args for the `--repository` flag, bypassing path restrictions. This allows access to any repo on the system. The fix enforced path validation. #CVE #CyberThreats ⚠️
Post summary
The tweet describes a path traversal flaw in CVE‑2025‑68145 that enables access to any repository, and notes that the issue has been fixed by enforcing path validation.
@ecap0_ CVE-2025-68145: Improper validation of `repo_path` arguments, bypassing `--repository` flag restrictions. Impact: Accesses any repo on the server. #SecurityFlaw 🔍
Post summary
CVE‑2025‑68145 is disclosed as an improper validation of repo_path arguments that lets users bypass repository restrictions and access any repository on the server.
MCP 生态的安全问题正在浮出水面，每个用 AI 编码工具的开发者都该关注。 Anthropic 自家的 Git MCP Server 被发现 3 个 CVE 漏洞（CVE-2025-68143、CVE-2025-68144、CVE-2025-68145），攻击者可以通过 prompt injection 实现远程代码执行和任意文件访问。攻击方式很巧妙——不需要你主动调用恶意工具，只要你的 AI 助手读到了一个被投毒的 README 文件，漏洞就能被触发。 OWASP 已经发布了 MCP Top 10 安全风险清单，Tool Poisoning 排第一。原理是：恶意指令被藏在 MCP 工具的 description 字段里，只要工具被加载到上下文中就会生效，不需要被调用。 三条基本操作： 一、只安装你信任的 MCP Server，定期检查更新 二、用 mcp-scan 扫描你安装的所有 MCP Server 三、遵循最小权限原则，别给 MCP Server 不必要的文件系统访问权 教训很明确——即使是官方维护的 MCP 服务器也不是绝对安全的。MCP 的便利和安全之间需要平衡。 https://owasp.org/www-project-mcp-top-10/
Post summary
Anthropic’s Git MCP Server has three newly disclosed CVEs (CVE‑2025‑68143, ‑68144, ‑68145) that enable remote code execution via prompt injection, with mitigation advice to trust servers, scan, and limit filesystem access.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | lfprojects | model_context_protocol_servers | - | - | - |