Read-only Git MCP calls executed commands supplied by repository configuration

A Git repository is not passive input. Its local configuration can instruct Git to launch helper programs, including a filesystem monitor. In the reference Git MCP server, apparently read-only status and diff tools could invoke those programs with the MCP server’s filesystem and environment privileges.

The reporter reproduced execution with an attacker-controlled repository whose .git/config survived workspace transfer. A normal source ZIP or fresh clone does not reproduce that exact condition because it does not include the original local Git configuration. The 2026.11.11 patch overrides dangerous helpers and refuses older Git versions that cannot honor the protective configuration. This is a code-execution boundary failure, not evidence that every repository URL is exploit-ready.

The repository is executable configuration as well as content. The specific setup requires retaining .git/config through workspace transfer; a fresh clone generally will not copy that local configuration, so not every remote repository meets the prerequisite. Repository helper execution is a separate vulnerability from Git object-store alternates escaping the allowed path.

A later independent replication exercised seven repository-controlled execution sinks, finding seven successful helper invocations on version 2026.11.4 but none on the repaired 2026.11.11 build. That is strong evidence for the listed regression set, although users running cached uvx executables or older container image digests still need to verify the actual code launched.