Evidence · DiggingBeagle record
mcp-server-git alternate object-store path escapes repository boundaries
Reproduction report for Git alternate-object storage outside a selected project.
- Published
- Nov 9, 2026
- Source role
- primary disclosure
Evidence record
Reproduction report for Git alternate-object storage outside a selected project.
Claim-level citations (1)
- supportsMCP Git repository confinement missed alternate object stores: The issue reports that objects/info/alternates redirects Git object lookup to paths beyond the configured repository root.
Issue description and reproduction steps