Repository navigation
[GHSA-6hqx-gqrx-c5r2] - mcp-server-git: arbitrary command execution via a repository's own Git configuration (core.fsmonitor) during read-only tools #5511
Description
Tracked the public fix for two published mcp-server-git security advisories:
- GHSA-6hqx-gqrx-c5r2: mcp-server-git: arbitrary command execution via a repository's own Git configuration (core.fsmonitor) during read-only tools
- GHSA-q74p-4wrc-q7w6: mcp-server-git: Incomplete Fix for GHSA-w766-5x43-whvw in validate_opened_repo() Allows --repository Confinement Bypass via objects/info/alternates and Linked-Worktree common_dir Confusion
Fixed by #5514, shipped in mcp-server-git 2026.11.11 in the v2.4.0 release. The advisories carry the details, the affected versions and the credits.
Activity
[-][GHSA-6hqx-gqrx-c5r2][/-][+][GHSA-6hqx-gqrx-c5r2] - mcp-server-git: arbitrary command execution via a repository's own Git configuration (core.fsmonitor) during read-only tools[/+]