Model Context Protocol Servers’ git_add tool fails to verify that paths specified in the files argument remain within the repository. This deficiency permits an attacker to craft relative paths containing sequences such as '../' that resolve to locations outside the intended repository. By doing so, the attacker can stage arbitrary files into the Git index, potentially overwriting or adding files critical to the server’s operation or secrets. The weakness exemplifies a classic directory traversal flaw (CWE-22).

Any installation of Model Context Protocol Servers using a version prior to 2026.1.14 is vulnerable. The issue resides in the mcp-server-git component and is part of the reference implementation set for the model context protocol (MCP).

The vulnerability carries a CVSS score of 6.4, indicating moderate severity. The EPSS score is below 1%, suggesting a very low probability of exploitation as of this assessment. The CVE is not listed in CISA’s KEV catalog. Exploitation requires the ability to invoke git_add with a crafted files argument; if git_add is exposed through remote APIs or automation scripts, an unauthenticated or authenticated attacker could potentially cause the server process to write files outside the repository, leading to integrity or confidentiality violations. The lack of path validation thus elevates the risk for deployments that allow untrusted input to the git_add tool.