CVE-2025-68145 is a path validation flaw in mcp-server-git, the Model Context Protocol git server. Tool calls could reach repositories outside the configured one. The record scores it critical (CVSS 9.1) and the advisory medium. Upgrade to version 2025.12.18 or later.
What's affected
mcp-server-git, published on PyPI, in versions before the fix. The record says versions prior to 2025.12.17, and advises upgrading to 2025.12.17 on release. The GitHub advisory, which I fetched, names 2025.12.18 as the patched version and lists everything before it as affected. The two disagree by one release, so use 2025.12.18 or later.
Severity also differs. The NVD record scores it 9.1, critical. The GitHub advisory rates it medium. The issue only applies when the server is started with the repository restriction option. Without that option there is no configured boundary to bypass.
How to check if you're exposed
Check which version of the package is installed where the MCP server runs:
pip show mcp-server-git
uvx --version
pip list 2>/dev/null | grep -i mcp-server-git
If you launch the server through uvx or a client configuration file, look at the command in your MCP client settings, and check whether it pins a version. Then check whether the repository restriction option is set in that command. If it is set, you relied on a boundary that older versions did not enforce.
What to do now
- Find MCP client configurations that start mcp-server-git.
- Update to 2025.12.18 or later and restart the clients so they launch the new version.
- Run the server as a user that can only read the repositories it should reach.
- Do not keep unrelated repositories or secrets on a machine that runs the server.
- Review which tools your AI client may call without confirmation.
Why it matters
The weakness is CWE-22, path traversal. The server accepted a repository path in each tool call but did not check that it was inside the configured repository. The fix resolves both paths, follows symlinks and verifies that the requested path is inside the allowed one before running any git operation.
The pattern matters for agent tools in general. A restriction set at startup gives a false sense of safety if each call can name its own target. Treat arguments chosen by a model as untrusted, and enforce limits in the tool, in file system permissions and in the account the tool runs as. The record does not list this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the fix 2025.12.17 or 2025.12.18?
The record mentions 2025.12.17 as the upcoming release. The GitHub advisory names 2025.12.18 as the patched version, so use that or later.
Am I affected if I never set the repository option?
The advisory describes the flaw as skipping validation when that option is set. Without it, the server has no configured boundary, though you should still upgrade.
Sources
Last reviewed: 18 October 2026.
