Git MCP Argument Injection: The Boundary Between Refs and CLI Options
A published mcp-server-git vulnerability let ref inputs to git_diff and git_checkout become Git CLI options, creating a local-file overwrite path. Adoption requires a patched artifact, semantic ref validation, and restricted process authority.
Read in JapaneseOn December 17, 2025, the official Model Context Protocol servers project published an advisory for git_diff and git_checkout in the pip package mcp-server-git. Values intended to be Git refs could instead be interpreted as command-line options by the Git process. The advisory says this could enable local file overwrites. Versions before 2025.12.18 are affected, and 2025.12.18 is the listed patched version.
The failed boundary was semantic. The tool schema described a comparison target or branch name, but the downstream Git CLI received an argument that could select another command behavior. A tool labeled as a read operation can therefore have a write effect if an option-like value crosses the process boundary. The tool name and a read-only annotation do not establish what the invoked program will do.
Check both the shape and meaning of a ref
The official patch adds two input checks. It rejects a value beginning with - before calling Git. It then uses rev_parse to confirm that the value resolves as an existing Git ref. Only a value that passes both checks reaches git_diff or git_checkout.
| Review point | Insufficient evidence | Acceptance evidence |
|---|---|---|
| Distributed package | Package name in configuration | Deployed mcp-server-git is a supported patched release at or after 2025.12.18 |
| Argument shape | String that resembles a branch | Option-like values rejected before Git execution |
| Ref meaning | Startup succeeds | Required branch, commit, and relative-ref cases resolve and work |
| Process authority | Application validation alone | Dedicated account or container cannot write unrelated host files |
Rejecting a leading hyphen does not prove that any remaining string is a valid ref. Conversely, resolution alone is weaker if an unusual ref has been created through another path. Shape validation and semantic resolution answer different questions, which is why the patch applies both.
Verify the artifact that actually runs
Record the MCP client's launch command, the Python environment it invokes, and the resolved package version as one unit. The official README documents both direct execution with uvx and installation with pip. A declaration in one project file therefore may not identify the package used by the running client. Check the uvx resolution and cache, the selected virtual environment, or the package inside the deployed container image according to the real launch path.
In a harmless test repository, confirm that the valid forms your workflow needs still work: a branch name, a commit hash, and a relative ref where applicable. Also confirm that option-like input is rejected before Git runs and that no file outside the test area is created or changed. Keep the result tied to the same package artifact and launch command used in the deployment.
git_checkout remains an intentionally mutating operation after the security fix. A valid branch change can alter the working tree and interact with uncommitted work. Define which repositories permit checkout, how local changes are protected, and when a person must approve that operation. The argument fix prevents one unintended interpretation; it does not remove the intended authority of the tool.
Scope and limitations
This analysis uses the official advisory, patch, and README reviewed on September 22, 2026. It does not claim that MCP Guard discovered the issue or that a particular current installation is affected. Current impact depends on the deployed pip package version and who can invoke the relevant tools. The published advisory and patch address git_diff and git_checkout; they do not prove that every argument accepted by other Git tools is safe, or that legitimate Git operations cannot damage a working tree.