CVE-2025-53107

@cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories. Prior to version 2.1.5, there is a command injection vulnerability caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (|, >, &&, etc.). An MCP Client can be instructed to execute additional actions for example via indirect prompt injection when asked to read git logs. This issue has been patched in version 2.1.5.

• CWE-77

• https://github.com/cyanheads/git-mcp-server/commit/0dbd6995ccdf76ab770b58013034365b2d06c4d9
• https://github.com/cyanheads/git-mcp-server/releases/tag/v2.1.5
• https://github.com/cyanheads/git-mcp-server/security/advisories/GHSA-3q26-f695-pp76

Published

Jul 1, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53101ImageMagick is free and open-source software used for editin…9.8
• CVE-2025-53102Discourse is an open-source community discussion platform. P…9.8
• CVE-2025-53103JUnit is a testing framework for Java and the JVM. From vers…5.8
• CVE-2025-53104gluestack-ui is a library of copy-pasteable components & pat…9.1
• CVE-2025-53105GLPI, which stands for Gestionnaire Libre de Parc Informatiq…7.5
• CVE-2025-53106Graylog is a free and open log management platform. In versi…8.8
• CVE-2025-53108HomeBox is a home inventory and organization system. Prior t…5.3
• CVE-2025-53109Model Context Protocol Servers is a collection of reference …7.3
• CVE-2025-53110Model Context Protocol Servers is a collection of reference …7.3
• CVE-2025-53111GLPI is a Free Asset and IT Management Software package. In …6.5
• CVE-2025-53112GLPI is a Free Asset and IT Management Software package, tha…4.3
• CVE-2025-53113GLPI, which stands for Gestionnaire Libre de Parc Informatiq…2.7