Git MCP Server advisory GHSA-vjqx-cfc4-9h6v

Evidence record

Maintainer security advisory for CVE-2026-27735. It identifies GitPython git_add out-of-tree path staging before 2026.1.14, potential disclosure through subsequent Git operations and the Git CLI staging replacement in the corrected version.

Read the original source ↗

Claim-level citations (3)

• supportsPatched Git MCP staging could include files outside the repository: The maintainer advisory assigns CVE-2026-27735 to Git MCP Server versions before 2026.1.14. GitPython-based staging accepted paths outside the working tree, potentially exposing their contents through later Git operations.

  Advisory description and affected-version range

• supportsPatched Git MCP staging could include files outside the repository: Version 2026.1.14 replaces the staging operation with the Git CLI, which rejects paths outside the working tree.

  Patched versions and fix description referencing pull request 3164

• supportsPatched Git MCP staging could include files outside the repository: The advisory describes disclosure through subsequent Git operations as a potential consequence of staging an external file; it does not claim that the git_add call alone transmits the file to a remote party.

  Maintainer advisory, Description, statement on staging and subsequent commit and push