CVE-2025-68143

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68143
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68143.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-68143
Aliases
Published
2025-12-17T22:09:43.159Z
Modified
2026-03-01T02:55:08.424340Z
Severity
  • 6.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
Details

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2025.9.25, the gitinit tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, gitinit could operate on any directory accessible to the server process, making those directories eligible for subsequent git operations. The tool was removed entirely, as the server is intended to operate on existing repositories only. Users are advised to upgrade to 2025.9.25 or newer to remediate this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68143.json"
}
References

Affected packages

Git / github.com/modelcontextprotocol/servers

Affected ranges

Type
GIT
Repo
https://github.com/modelcontextprotocol/servers
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
aa5a4f1c74637e153a066c8cdeb9ff5c56d2843c

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68143.json"