What’s Vulnerable › Products

modelcontextprotocol servers vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your modelcontextprotocol servers version is affected

Latest modelcontextprotocol servers vulnerabilities

• CVE-2026-27735 — mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries (CVSS 6.5)
• CVE-2025-68145 — mcp-server-git has missing path validation when using --repository flag (CVSS 9.1)
• CVE-2025-68144 — mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files (CVSS 7.1)
• CVE-2025-68143 — mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations (CVSS 8.8)
• CVE-2025-53110 — Model Context Protocol Servers Vulnerable to Path Validation Bypass via Colliding Path Prefix (CVSS 7.3)
• CVE-2025-53109 — Model Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handling (CVSS 7.3)