Prompt Injection Vulnerabilities in Anthropic Git MCP Server Enable Code Execution
Three prompt injection vulnerabilities in Anthropic's mcp-server-git reference implementation were discovered by Cyata Security, allowing attackers to execute code, delete files, and access arbitrary files through malicious content an AI assistant reads. Anthropic accepted the reports in September 2025 and released patches in December 2025 for all affected versions before December 8, 2025.
What happened
Three prompt injection vulnerabilities were identified in mcp-server-git, Anthropic's reference implementation for the Model Context Protocol Git server, affecting all versions released before December 8, 2025. The flaws include an unrestricted git_init capability that allowed repository initialization at arbitrary filesystem paths, a path validation bypass that enabled access to repositories outside the configured allowlist, and an argument injection flaw in the git_diff tool that passed unsanitized input to Git commands.
An attacker only needs to influence what an AI assistant reads, such as a malicious README file, poisoned issue description, or compromised webpage, to trigger the vulnerabilities. No credentials or direct system access are required. The vulnerabilities were assigned CVE-2025-68143, CVE-2025-68144, and CVE-2025-68145.
Reported impact
When chained together, the flaws allow attackers to execute code when mcp-server-git is used alongside a filesystem MCP server, delete arbitrary files, and load arbitrary files into the AI's context. The vulnerabilities worked 'out of the box' in default installations, increasing the likelihood of real-world impact.
While the vulnerabilities do not directly exfiltrate data, sensitive files may be exposed to the AI, creating downstream security and privacy risks. In one case, unsanitized arguments to git_diff allow file overwriting, and misuse of git_init enables file deletion or prepares the ground for code execution when combined with file-writing capabilities.
Index analysis
The vulnerabilities are notable because they affect Anthropic's reference MCP implementation, which is described as the canonical Git MCP server that developers are expected to copy. Previous MCP-related issues typically relied on unusual configurations or unsafe deployments, but these flaws worked in default configurations.
The risk increases significantly when the Git MCP server is used alongside the Filesystem MCP server, where attackers can abuse Git's smudge and clean filters to execute shell commands defined in repository configuration files to achieve remote code execution.
Governance controls
Anthropic accepted the vulnerability reports in September 2025 and released fixes in December 2025. Cyata advised affected users to update immediately and review how MCP servers are combined in their environments.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.