7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53107

CVE-2025-53107: @cyanheads/git-mcp-server vulnerable to command injection in several tools

Summary

A command injection vulnerability exists in the git-mcp-server MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges.

The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (|, >, &&, etc.).

Details

The MCP Server exposes tools (git_add, git_init, git_logs, etcc) to perform several git operations. An MCP Client can be instructed to execute additional actions for example via indirect prompt injection when asked to read git logs. Below some example of vulnerable code and different ways to test this vulnerability including a real example of indirect prompt injection that can lead to arbitrary command injection.

Vulnerable code

The following snippet illustrates the vulnerable code pattern used in the MCP Server’s tooling. Note: These are only some instances, but similar patterns may exist elsewhere in the codebase.

git_init

import { exec } from "child_process";
...
const execAsync = promisify(exec);

// https://github.com/cyanheads/git-mcp-server/blob/v2.1.4/src/mcp-server/tools/gitInit/logic.ts#L122-L138
    let command = `git init`;
    if (input.quiet) {
      command += " --quiet";
    }
    if (input.bare) {
      command += " --bare";
    }
    // Determine the initial branch name, defaulting to 'main' if not provided
    const branchNameToUse = input.initialBranch || "main";
    command += ` -b "${branchNameToUse.replace(/"/g, '\\"')}"`;

    // Add the target directory path at the end
    command += ` "${targetPath}"`; //<---

    logger.debug(`Executing command: ${command}`, { ...context, operation });

    const { stdout, stderr } = await execAsync(command);

Miggo Vulnerability Database

→

CVE-2025-53107

CVE-2025-53107:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@cyanheads/git-mcp-server	npm	<= 2.1.4	2.1.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The core of the vulnerability lies in the widespread use of child_process.exec throughout the git-mcp-server codebase. The application constructs git commands as simple strings, concatenating user-provided input directly into these strings. This is a classic command injection vulnerability. An attacker can provide malicious input containing shell metacharacters (e.g., |, &&, ;, $()) to break out of the intended git command and execute arbitrary commands on the server's operating system. The vulnerability is present in almost every tool (git_add, git_init, etc.) that the server exposes, as they all follow this insecure pattern of command construction and execution. The provided patch systematically replaces all calls to exec with execFile. The execFile function is inherently safer because it accepts command-line arguments as an array of strings, ensuring that user input is treated as data rather than executable code by the shell. My analysis of the patch commit confirmed that a large number of functions were modified, and each of these functions represents a potential vector for exploitation. The PoC in the description demonstrates how even indirect input, like a git log message, can be used to trigger this vulnerability, highlighting the severity and pervasive nature of the issue.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-53107: @cyanheads/git-mcp-server vulnerable to command injection in several tools

Summary

Details

Vulnerable code

CVE-2025-53107:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

7.5

7.5

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

CVE-2025-53107: @cyanheads/git-mcp-server vulnerable to command injection in several tools

Summary

Details

Vulnerable code

PoC

Realistic Example - Indirect prompt injection via git logs

Using MCP Inspector

Using an IDE (I used Cursor)

Remediation

Impact

References

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI