The tool did not enforce a supplied old blob SHA and accepted directory paths. Entry and authority. An agent holds repository write permission, reads a blob, and another actor changes it before deletion. Observed mechanism and consequence. The issue reproduces deletion of the newer blob despite a stale precondition and removal of a nested directory…
Inspect the ClaimsCase · DiggingBeagle record
GitHub MCP file deletion ignored stale SHA and could remove subtrees
The tool did not enforce a supplied old blob SHA and accepted directory paths.
Public disclosure: Nov 9, 2026
Scope
An agent holds repository write permission, reads a blob, and another actor changes it before deletion. The issue reproduces deletion of the newer blob despite a stale precondition and removal of a nested directory through a file-named tool.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- none known
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GITHUB-MCP-DELETE-SHA; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-GITHUB-MCP-DELETE-SHA-01 · CLM-ENR234-DB233-GITHUB-MCP-DELETE-SHA · github-mcp-server issue #3757
At a glance
Unmerged issue finding; no confirmed live victim or patch release.
Limits and uncertaintyFull account
The tool did not enforce a supplied old blob SHA and accepted directory paths.
Entry and authority. An agent holds repository write permission, reads a blob, and another actor changes it before deletion.
Observed mechanism and consequence. The issue reproduces deletion of the newer blob despite a stale precondition and removal of a nested directory through a file-named tool.
Limits and status. Unmerged issue finding; no confirmed live victim or patch release.
The GitHub MCP delete tool accepted a file path and a claimed old blob SHA but did not enforce that SHA as a precondition. In the reported two-writer sequence, another actor changed the file after it was read, and the stale request still removed the new content. When the path selected a directory, the operation also removed descendants. The issue author reproduced the discrepancy; GitHub repository write permission remains an independent prerequisite.
Mechanism and trust boundary
- 01
Precondition and trust context
An agent holds repository write permission, reads a blob, and another actor changes it before deletion.
- 02
Crossed boundary
The issue reproduces deletion of the newer blob despite a stale precondition and removal of a nested directory through a file-named tool.
- 03
Observed limit
Unmerged issue finding; no confirmed live victim or patch release.
Timeline
- Nov 9, 2026Event type unspecified
Initial documented finding
GitHub MCP file deletion ignored stale SHA and could remove subtrees
- Nov 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-GITHUB-MCP-DELETE-SHA-01A repository issue reports: The issue reproduces deletion of the newer blob despite a stale precondition and removal of a nested directory through a file-named tool.supported
Basis: reported finding
- supportsgithub-mcp-server issue #3757primary disclosure
Issue #3757, description and reproduction
CLM-ENR234-DB233-GITHUB-MCP-DELETE-SHAThe issue reporter found that file deletion did not enforce the supplied old SHA, and that selecting a directory could remove all entries underneath it.supported
Basis: reported finding
- supportsgithub-mcp-server issue #3757primary disclosure
Issue #3757, reporter reproduction for stale-SHA and directory-path deletion
Controls and mitigations
- Reject stale deletes by enforcing the blob or tree SHA precondition and explicitly disallow directories in file-only operations.
- Return the full affected path set and pre/post version IDs so a caller can detect partial or wider-than-requested deletion.
Unknowns and contradictions
- Unmerged issue finding; no confirmed live victim or patch release.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235