CVE-2026-85626

Name of the Vulnerable Software and Affected Versions git-mcp-server version 2.15.1

Description An argument injection issue exists in the git log, git diff, and git show tools due to a lack of leading-dash validation in the ref and object parameters. This allows attackers to inject git command-line options, such as --output=, to write files to arbitrary paths accessible by the process outside of the repository.

Recommendations Update git-mcp-server to a version newer than 2.15.1.