CVE-2025-68143 json
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
published 10mo ago modified last mo. also GHSA-5cgr-j3jf-jw3v , PYSEC-2026-1621 , EUVD-2025-203936
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.1%
- EPSS 8.1% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, git_init could operate on any directory accessible to the server process, making those directories eligible for subsequent git operations. The tool was removed entirely, as the server is intended to operate on existing repositories only. Users are advised to upgrade to 2025.9.25 or newer to remediate this issue.
Patch / fix
- pypi mcp-server-git 2025.9.25
- lfprojects model_context_protocol_servers 2025.9.25
Is CVE-2025-68143 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 10mo ago
Exploit prediction
8.13% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H |
| CNA | 4.0 | 6.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mcp-server-git | <2025.9.25 |
2025.9.25 |
Affected products
- modelcontextprotocol servers
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/modelcontextprotocol/servers/commit/eac56e7bcde48fb64d5a973924d05d69a7d876e6
web, patch
-
github.com
/modelcontextprotocol/servers/security/advisories/GHSA-5cgr-j3jf-jw3v
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-68143
advisory
-
github.com
/modelcontextprotocol/servers
package
-
pypi.org
/project/mcp-server-git
package
-
github.com
/advisories/GHSA-5cgr-j3jf-jw3v
advisory
Sources
- CVE List CVE-2025-68143
- GitHub Advisory GHSA-5cgr-j3jf-jw3v
- NVD CVE-2025-68143
- OSV PYSEC-2026-1621
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.