Intelligence
Join the waitlist
AEV-2026-0035

git-mcp-server's read only git_log, git_diff and git_show tools accepted a ref value git parsed as a write option (CVE-2026-85626)

git_log's branch, git_diff's source and target, and git_show's object all shared one schema with no rejection of a leading hyphen, and an executor level allow list that deliberately left a hyphen prefixed value carrying an equals sign unenforced. This entry confirmed directly, by running the affected v2.15.1 source, that a branch value of --output=<path> reached git positionally and caused a write outside the repository, through tools each annotated readOnlyHint: true. Formally assigned CVE-2026-85626 on 4 September 2026; this entry separately confirmed, from the current source and the npm registry's own publish timestamps, that both layers were rewritten and the fix shipped to npm's latest tag, version 2.15.3, the version the advisory itself lists as the upper bound of the affected range, eleven days before the advisory's own publication date.

AESS 7.1 highConfirmedStatus: publishedEvent: 4 September 2026Execution AuthorityEnvironment Boundaries

Affected

Organisation
cyanheads
Product
git-mcp-server
Component
CommitRefSchema, shared by git_log's branch, git_diff's source and target, and git_show's object (src/mcp-server/tools/schemas/common.ts), and the validateGitArgs allow list called before every git process spawn (src/services/git/providers/cli/utils/command-builder.ts and git-executor.ts)
Versions
This entry independently confirmed the mechanism at the v2.15.1 tag, the version the underlying issue's own proof of concept targets, and independently confirmed a fix rewriting both the schema and the executor layer is present in version 2.15.2, published to npm 24 August 2026, and unchanged in version 2.15.3, published the same day and the version GitHub Security Advisory GHSA-p58h-f635-vjjm itself lists as the upper bound of the affected range
Configurations
Any deployment exposing git_log, git_diff or git_show to an untrusted caller, or to values an LLM agent itself generates for the branch, source, target or object parameter

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
Read commit history, a diff between two references, or the details of a git object, through git_log, git_diff or git_show
Agent
Whatever MCP client or LLM agent supplies the branch, source, target or object argument to the affected tool
Delegating actor
unknown
Action
A branch, source, target or object value shaped as a git command line option, confirmed directly as --output=<path>, reached git's own argument parser positionally, ahead of the -- separator, because CommitRefSchema accepted any non empty string and validateGitArgs's own isFlagWithValue branch took no action for a hyphen prefixed argument containing an equals sign, confirmed directly by running the v2.15.1 source
Target resource
A filesystem path outside the git repository the tool was scoped to, reachable by the process running git-mcp-server
Environment
unknown
Credentials used
unknown
Privileges available
Whatever filesystem write access the operating system process running git-mcp-server itself holds
Authority presented
Authority to invoke a tool the MCP server's own annotations declare non mutating, readOnlyHint: true, confirmed directly in each of the three tools' definitions
Authority required
Authority to write a file to an arbitrary path outside the repository, which no tool schema, annotation or approval in the reported mechanism separately grants
Applicable policy
unknown; whatever tool approval policy the invoking MCP client applies, which commonly treats a readOnlyHint of true as license to skip a confirmation step for exactly this class of tool
Approval mechanism
unknown
Required approver
unknown
Independent approval
unknown
Action binding
unknown
Sequence context
unknown

Impact

Consequence
A file write to a path the caller's own value named, outside the repository the tool was scoped to, confirmed directly by this entry's own run of the affected validator and schema against the reporter's own proof of concept value
Reach
single
Reversibility
unknown
Detectability
unknown
Propagation
A concrete propagation path exists, for example overwriting a file later executed or trusted by another process, but this entry did not observe the effect actually spreading to a further system
Recovery
Fixed in version 2.15.2, published to npm 24 August 2026, confirmed directly by this entry's own reading of the current source: CommitRefSchema now rejects any leading hyphen, and validateGitArgs now checks a flag's own name against an allow list with no equals sign exception. A same day regression fix, version 2.15.3, restored a small number of legitimate flags the new allow list had started rejecting. Both versions predate this CVE's own 4 September 2026 publication date by eleven days.

Evidence

Primary sources

Supporting sources

Reproduction status
Independently confirmed by Moona Intelligence reading and comparing the real, affected and fixed source directly, rather than by executing the git process against a live repository. This session downloaded common.ts, command-builder.ts and git-executor.ts at the v2.15.1 tag, the exact version the underlying issue's own proof of concept targets, confirmed the schema's absence of a leading hyphen check and the validator's own isFlagWithValue branch taking no action for --output=<path>, then downloaded the identical files from the current default branch and confirmed both were rewritten to reject the same value.
Evidence state
Confirmed

Known unknowns

  • Whether this has been exploited against a real git-mcp-server deployment.
  • Why GHSA-p58h-f635-vjjm's own affected range extends through version 2.15.3 when this entry's own reading of that exact version's source shows the fix already present, published to npm eleven days before the advisory's own publication date.
  • Which body served as the assigning CVE Numbering Authority for CVE-2026-85626; cve.org and nvd.nist.gov were both blocked by this session's network egress policy on every attempt.
  • Whether any tool beyond git_log, git_diff and git_show that also imports CommitRefSchema was separately reachable the same way before the fix; this entry does not extend the claim beyond the three tools issue 53 itself names.

Limitations

  • This session's direct fetch of cve.org and nvd.nist.gov was blocked by this session's network egress policy; CVSS, CWE and publication date are corroborated through the GitHub Advisory Database rather than read directly from the CVE Program's own record.
  • This entry verifies the mechanism by reading and comparing the affected and fixed source directly rather than by spawning a real git process against a live repository, since the exact validator and schema logic already establish the outcome and the fix is already shipped.

Claim provenance

  • verified
    GitHub's Security Advisory Database, fetched directly in this session, assigns CVE-2026-85626, published 4 September 2026, rates it CVSS 4.0 base score 8.7, High, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N, and classifies it CWE-88, against @cyanheads/git-mcp-server through version 2.15.3.
    The Tool Was Marked Read Only. Git Still Wrote the File.
  • verified
    Fetched directly in this session. States git_log's branch, git_diff's source and target, and git_show's object each accept a hyphen prefixed value with no rejection, states the proof of concept branch value --output=/tmp/GITMCP_LOG_OOB.txt, and states git_log carries readOnlyHint: true despite the reported write. Opened 8 July 2026 by a reporter identified as geo-chen, citing a private report from 5 June 2026, open with no maintainer reply recorded at the time of this entry.
    The Tool Was Marked Read Only. Git Still Wrote the File.
  • verified
    This session downloaded these exact files at the v2.15.1 tag and confirmed CommitRefSchema is z.string().min(1) with no leading hyphen check, and that validateGitArgs's own isFlagWithValue branch takes no action, with its own comment stating the choice directly and the strict rejection commented out beneath it, for a hyphen prefixed argument containing an equals sign such as --output=<path>.
    The Tool Was Marked Read Only. Git Still Wrote the File.
  • verified
    This session downloaded common.ts and command-builder.ts from the current default branch and confirmed CommitRefSchema now rejects any leading hyphen and validateGitArgs now checks a flag's own name with no equals sign exception. This session separately fetched the npm registry's own package metadata and confirmed version 2.15.2 published 2026-08-24T21:05:45.726Z and version 2.15.3 published 2026-08-24T21:56:00.237Z, with 2.15.3 as the current latest dist-tag, establishing the fix shipped eleven days before this CVE's own 4 September 2026 publication date under the version the advisory itself lists as affected.
    The Tool Was Marked Read Only. Git Still Wrote the File.