Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnAISquareMore
Multiple security vulnerabilities found in Anthropic's official Git MCP server, allowing for file read/write and potential remote code execution

Multiple security vulnerabilities found in Anthropic's official Git MCP server, allowing for file read/write and potential remote code execution

Odaily星球日报Odaily星球日报2026/01/21 00:22
Show original

According to Odaily, three security vulnerabilities have been discovered in the official mcp-server-git maintained by Anthropic. These vulnerabilities can be exploited through prompt injection attacks, allowing attackers to trigger the vulnerabilities via malicious README files or compromised web pages without direct access to the victim's system.

The vulnerabilities include: CVE-2025-68143 (unrestricted git_init), CVE-2025-68145 (path validation bypass), and CVE-2025-68144 (parameter injection in git_diff). If these vulnerabilities are used in conjunction with the file system MCP server, attackers can execute arbitrary code, delete system files, or read the contents of any file into the context of a large language model.

Cyata pointed out that since mcp-server-git does not validate the repo_path parameter, attackers can create Git repositories in any directory of the system. In addition, by configuring a clean filter in .git/config, attackers can run shell commands without execution permissions. Anthropic assigned CVE numbers and submitted patches for these vulnerabilities on December 17, 2025. Users are advised to update mcp-server-git to version 2025.12.18 or later. (cyata)

0
0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

Understand the market, then trade.
Bitget offers one-stop trading for cryptocurrencies, stocks, and gold.
Trade now!

You may also like

Coca-Cola (KO.US) plans to invest 10 billions USD to strengthen U.S. facilities and logistics infrastructure

Coca-Cola announced on Tuesday that it plans to invest $10 billions in U.S. infrastructure between 2026 and 2030.

智通财经2026/09/17 02:26
Coca-Cola (KO.US) plans to invest 10 billions USD to strengthen U.S. facilities and logistics infrastructure

The yen broke below the 156 mark overnight as the Federal Reserve’s hawkish rate hikes pushed the Bank of Japan to a “high-pressure moment.”

After the Federal Reserve raised interest rates, the Japanese yen fell overnight to 156.42. The market is betting that the Bank of Japan will raise rates by 25 basis points on Friday. If the stance is dovish, the yen could fall further to 158 or even 160.

智通财经2026/09/17 02:21
The yen broke below the 156 mark overnight as the Federal Reserve’s hawkish rate hikes pushed the Bank of Japan to a “high-pressure moment.”