git-mcp-server 2.15.1 suffers from an argument injection flaw in the ref and object parameters of the git_log, git_diff, and git_show utilities. The handler fails to validate that these parameters do not begin with a dash, allowing an attacker to inject git command‑line options such as --output= that direct the underlying git binary to write data to arbitrary filesystem locations outside the repository. Successful exploitation provides the attacker with the ability to create or overwrite files that are accessible to the process, potentially leading to privilege escalation or persistence mechanisms. The weakness is classified as CWE-88.

Vulnerable instances are running cyanheads git-mcp-server version 2.15.1. No other versions are specifically listed as affected in the CNA data, but the issue appears to have been addressed in subsequent releases such as 2.15.3.

With a CVSS score of 8.7, the vulnerability is rated as High severity. The EPSS score is unavailable, so the exact likelihood of exploitation cannot be quantified from the data, but the fact that it is in a widely used git server component suggests it could be targeted by attackers. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors include any context where an adversary can supply or influence git ref or object parameters—this could be a remote API call, a local script execution, or any integration that forwards user supplied values to the git-mcp-server tooling. Exploitation requires the ability to insert a leading dash into the parameter, and the ineffectiveness of input filtering is the root cause.