PT-2026-85550

CVE-2026-85626

Published

2026-09-04

Updated

2026-09-10

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions git-mcp-server version 2.15.1

Description An argument injection issue exists in the git log, git diff, and git show tools due to a lack of leading-dash validation in the ref and object parameters. This allows attackers to inject git command-line options, such as --output=, to write files to arbitrary paths accessible by the process outside of the repository.

Recommendations Update git-mcp-server to a version newer than 2.15.1.

Exploitability

Exploit

Fix

Impacts

Researchers

George Chen

Jashn Wahi

Vendors

Affected products

Weakness enumeration

CWE-88: Improper Neutralization of Argument Delimiters in a Command (\'Argument Injection\')