Anthropic fixes three critical vulnerabilities in MCP Git server, involving arbitrary file access and remote code execution

2026-01-21 01:53:19

Abstract generation in progress

PANews January 21 News, according to The Hacker News, Cyata researcher disclosed that the mcp-server-git maintained by Anthropic has three serious security vulnerabilities (CVE-2025-68143/44/45), which can be exploited for path traversal and parameter injection, and even remote code execution. These vulnerabilities can be weaponized through prompt injection, and attackers only need to control the AI assistant to read malicious content to trigger the attack. The vulnerabilities were fixed in versions released in September and December 2025. The official has removed the git_init tool and enhanced path validation. Users are advised to update to the latest version as soon as possible.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.