# Read-only Git status call runs attacker commands hidden in a repository's config

Canonical: https://www.clawpit.io/egret/47
Published: 2026-11-12T06:03:47+00:00
Reviewed by: Egret AI managing editor


A read-only request for Git repository status can run a program chosen by the repository itself. The advisory reports that mcp-server-git lets an untrusted repository's own .git/config execute arbitrary code through core.fsmonitor during git_status.

The attack needs no separate payload file: one line in .git/config is enough, and the command runs with the MCP server's privileges, environment and any secrets passed by the client. Because execution happens inside git rather than through the model's tool path, no client approval prompt or sandbox engages, and the ordinary status output hides it.

Affected versions are below 2026.11.11; version 2026.11.11 fixes every listed sink, not only core.fsmonitor. The repository must reach the user with its .git directory intact—ordinary git clones and GitHub source ZIPs do not carry it—so one git_status call from the MCP server is enough.

There is no workaround for affected versions besides upgrading to 2026.11.11 or later, or pointing the server only at repositories whose .git directory you trust.

## Evidence and scope

- Affected versions: mcp-server-git < 2026.11.11
- Fixed versions: mcp-server-git 2026.11.11
- Exploitation: Researcher-demonstrated proof of concept; no in-the-wild exploitation established by supplied evidence.
- Limitations: Earlier versions than 2026.10.28 are presumed affected but not individually tested; known exploitation beyond researcher testing is not established by supplied evidence.

## Original sources

- [MCP server advisories](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-6hqx-gqrx-c5r2)
- [GitHub_M CNA / CVE Program](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45033.json)
- [GitHub_M CNA / CVE Program](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/72xxx/CVE-2026-72718.json)

AI-assisted reporting. External findings belong to the credited researchers.