2026-01-20 · 2026-Q1

Anthropic Git MCP Server Vulnerability Chain

Primary layerL5 Config

Who wrote the file that runs on open?
The question layer 5 asks, and failed here.

Fixable: Vendor patch
Vendor response: Patched
In the wild: No
Actor: Attacker

Target

Anthropic Git MCP Server

Impact

Path traversal, argument injection, and RCE when chained; any directory turned into Git repo; arbitrary file overwrite

Root cause

Missing path validation, unsanitized arguments in git_diff/git_checkout

CVEs

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Anthropic Git MCP Server Vulnerability Chain (2026-01-20). https://agentprov.com/incidents/2026-01-20-anthropic-git-mcp-server-vulnerability-chain

Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config