CVE-2026-27735 json
mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
published 2026-02-25 8 mo ago modified 2026-07-13 3 mo ago also GHSA-vjqx-cfc4-9h6v , PYSEC-2026-2630 , EUVD-2026-8770
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries. Because the tool used GitPython's repo.index.add() rather than the Git CLI, relative paths containing `../` sequences that resolve outside the repository were accepted and staged into the Git index. Users are advised to upgrade to 2026.1.14 or newer to remediate this issue.
Patch / fix
- pypi mcp-server-git 2026.1.14
- lfprojects model_context_protocol_servers 2026.1.14
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N |
| CNA | 4.0 | 6.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mcp-server-git | <2026.1.14 |
2026.1.14 |
Affected products
- modelcontextprotocol servers
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/modelcontextprotocol/servers/pull/3164
web, issue-tracking, patch
-
github.com
/modelcontextprotocol/servers/security/advisories/GHSA-vjqx-cfc4-9h6v
web, patch, vendor-advisory
-
github.com
/modelcontextprotocol/servers/commit/862e717ff714987bd5577318df09858e14883863
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-27735
advisory
-
github.com
/modelcontextprotocol/servers
package
-
pypi.org
/project/mcp-server-git
package
-
github.com
/advisories/GHSA-vjqx-cfc4-9h6v
advisory
Sources
- CVE List CVE-2026-27735
- GitHub Advisory GHSA-vjqx-cfc4-9h6v
- NVD CVE-2026-27735
- OSV PYSEC-2026-2630
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.