CVE-2026-85626: Cyanheads Git-Mcp-Server

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths accessible by the process.

Affected products

• Cyanheads Git-Mcp-Server: up to and including 2.15.3

Published 2026-09-04. Last modified 2026-09-23.