Read-only Git status call runs attacker commands hidden in a repository's config
A read-only request for Git repository status can run a program chosen by the repository itself. The advisory reports that mcp-server-git lets an untrusted repository's own .git/config execute arbitrary code through core.fsmonitor during git_status.
- Affected
- mcp-server-git < 2026.11.11
- Fixed
- mcp-server-git 2026.11.11
The attack needs no separate payload file: one line in .git/config is enough, and the command runs with the MCP server's privileges, environment and any secrets passed by the client. Because execution happens inside git rather than through the model's tool path, no client approval prompt or sandbox engages, and the ordinary status output hides it.
Affected versions are below 2026.11.11; version 2026.11.11 fixes every listed sink, not only core.fsmonitor. The repository must reach the user with its .git directory intact—ordinary git clones and GitHub source ZIPs do not carry it—so one git_status call from the MCP server is enough.
There is no workaround for affected versions besides upgrading to 2026.11.11 or later, or pointing the server only at repositories whose .git directory you trust.
Sources & technical scope 3 sources
MCP server advisories — original source ↗
GitHub_M CNA / CVE Program — original source ↗
GitHub_M CNA / CVE Program — original source ↗
Affected: mcp-server-git < 2026.11.11
Fixed: mcp-server-git 2026.11.11
Exploitation: Researcher-demonstrated proof of concept; no in-the-wild exploitation established by supplied evidence.
Scope & limitations: Earlier versions than 2026.10.28 are presumed affected but not individually tested; known exploitation beyond researcher testing is not established by supplied evidence.
External findings belong to the credited researchers.