PulseAugur
EN
LIVE 05:52:23

mcp-server-git vulnerability allowed repository escapes until 2026.10.28

By PulseAugur Editorial · [1 sources] ·

A security vulnerability in the mcp-server-git tool allowed it to access repositories outside its designated boundary, a flaw that persisted until version 2026.10.28. The vulnerability, identified as GHSA-w766-5x43-whvw, was reported by ShieldPi and rated as Moderate. It exploited a Git feature where a nested .git file could redirect the server to an unintended repository, enabling unauthorized reading and modification of external content. This is the third such advisory for mcp-server-git, highlighting a history of issues with its repository confinement. AI

IMPACT Security flaw in a Git tool could impact AI development workflows relying on code repositories.

RANK_REASON Security vulnerability disclosure for a specific software tool.

Read on dev.to — MCP tag →

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →

mcp-server-git vulnerability allowed repository escapes until 2026.10.28

How we ranked this

Signal score
13 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
Security vulnerability disclosure for a specific software tool.
Source corroboration
Single-source cluster
Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics
product
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
Breaking (< 6h)
Fresh story with cross-source coverage still developing. Ranking may shift as more sources report.

Full methodology in our editorial standards.

COVERAGE [1]

  1. dev.to — MCP tag TIER_1 English(EN) · Rulestack ·

    A nested .git file let the Git MCP server out of its --repository until 2026.10.28. Which version does your uvx run?

    <blockquote> <p><code>mcp-server-git --repository &lt;path&gt;</code> is the one setting that keeps the reference Git MCP server inside a single repository. An advisory published on 2026-10-28 showed that a nested directory with a <code>.git</code> file pointing elsewhere let too…

RELATED ENTITIES

RELATED TOPICS