modelcontextprotocol servers vulnerabilities

CVEs per yearBy the year they were published

1. 20255
2. 20261

Newest CVEs

• CVE-2026-27735

  mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

  modelcontextprotocol · servers

  Medium6.4
• CVE-2025-68145

  mcp-server-git has missing path validation when using --repository flag

  modelcontextprotocol · servers

  Medium6.4
• CVE-2025-68144

  mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

  modelcontextprotocol · servers

  Medium6.3
• CVE-2025-68143

  mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

  modelcontextprotocol · servers

  Medium6.5
• CVE-2025-53109

  Model Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handling

  modelcontextprotocol · servers

  High7.3
• CVE-2025-53110

  Model Context Protocol Servers Vulnerable to Path Validation Bypass via Colliding Path Prefix

  modelcontextprotocol · servers

  High7.3