CyberRota Analysis
AI-GeneratedThe argument injection vulnerability in git-mcp-server 2.15.1 affects the ref and object parameters of the git_log, git_diff, and git_show tools, allowing attackers to inject malicious command-line options. This could lead to unauthorized file writing outside the repository to arbitrary paths, posing a significant risk to system integrity. Organizations using this version of git-mcp-server should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths accessible by the process.