DIGGINGBEAGLE

Case · DiggingBeagle record

Patched Git MCP staging could include files outside the repository

Model-controlled tool parametersMCP control-plane exposure
Scope

A source-confirmed vulnerability in mcp-server-git versions before 2026.1.14. The advisory describes unauthorized staging and possible later disclosure; it does not document a customer exfiltration campaign or prove that every tool call leaks a secret.

Assessment profile

Assessment method
Setting
research demonstration
Exploitation
demonstrated
Evidence
Grade B
Remediation
patch available
AI role
AGAINST AI
Basis and provenance

The maintainer GitHub advisory was read directly and identifies the affected staging call, path-traversal precondition and corrected release. There is no inspected production incident, customer exfiltration trace or independent local reproduction. Impact remains ungraded because the available evidence does not establish realized harm or a defensible general severity for the assessed deployment.

Assessed Oct 16, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-GIT-MCP-27735-TRAVERSAL-01 · CLM-GIT-MCP-27735-TRAVERSAL-02 · CLM-GIT-MCP-27735-TRAVERSAL-03 · Git MCP Server advisory GHSA-vjqx-cfc4-9h6v

At a glance

Mechanism and trust boundary

  1. 01

    Provide an out-of-tree path to git_add

    A model, user or lower-trust tool result causes the MCP file-list argument to contain parent-directory traversal segments.

    Boundary: tool argument / intended repository root

  2. 02

    GitPython stages a host file

    Before 2026.1.14, the implementation accepts that path and writes a Git index entry for data outside the intended working tree.

    Boundary: repository abstraction / agent-host filesystem

  3. 03

    A later Git operation may disclose staged contents

    Commit, diff or push access could expose staged bytes. The advisory does not establish that such a later operation occurred against a production victim.

    Boundary: local staged content / consumer or remote repository

  4. 04

    Patched staging rejects the path

    Release 2026.1.14 switches to Git CLI staging, which rejects files outside the working tree for the documented path.

    Boundary: input validation / Git CLI enforcement

Timeline

  1. Feb 25, 2026
    disclosure

    Public disclosure

Claims & evidence

CLM-GIT-MCP-27735-TRAVERSAL-01The maintainer advisory assigns CVE-2026-27735 to Git MCP Server versions before 2026.1.14. GitPython-based staging accepted paths outside the working tree, potentially exposing their contents through later Git operations.supported

Basis: reported finding

Link to claim
CLM-GIT-MCP-27735-TRAVERSAL-02Version 2026.1.14 replaces the staging operation with the Git CLI, which rejects paths outside the working tree.supported

Basis: reported finding

Link to claim
CLM-GIT-MCP-27735-TRAVERSAL-03The advisory describes disclosure through subsequent Git operations as a potential consequence of staging an external file; it does not claim that the git_add call alone transmits the file to a remote party.supported

Basis: reported finding

Link to claim

Implications

A narrow tool name does not confine a library's file access. Upgrading removes the documented staging primitive, while process-level confinement can provide an independent boundary for future defects. Neither step alone proves that other Git tools or chained operations are harmless.

Controls and mitigations

  • Upgrade mcp-server-git to version 2026.1.14 or a later supported release and verify the installed package actually contains the Git CLI staging fix.
  • Test relative parent paths, absolute paths and filesystem links with harmless fixtures on isolated installations.
  • Give the MCP server only the filesystem access required for its repositories; a corrected path check is not a substitute for operating-system containment.
  • Audit subsequent Git commit, diff and push activity separately before asserting that host secrets left the machine.

Unknowns and contradictions

  • The advisory does not identify a confirmed real-world exfiltration campaign or affected customer population.
  • The October MCP-FSD study mentioned in related Radar material is a separate source and was not included as an editable or primary-evidence record in this session.
  • Whether secondary controls such as process-level filesystem containment were deployed in particular affected installations is unknown.

Sources and citation

EvidenceGit MCP Server advisory GHSA-vjqx-cfc4-9h6v

Material revision history

  1. Oct 16, 2026 · Canonical change recorded · new in release · revision 160
Record metadata

Canonical ID: CASE-2026-GIT-MCP-27735-TRAVERSAL · revision 160