CVE-2026-27735
Description
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries. Because the tool used GitPython's repo.index.add() rather than the Git CLI, relative paths containing `../` sequences that resolve outside the repository were accepted and staged into the Git index. Users are advised to upgrade to 2026.1.14 or newer to remediate this issue.
How to fix
- lfprojects model_context_protocol_servers2026.1.14 or later
- mcp-server-git2026.1.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lfprojects model_context_protocol_servers | v < 2026.1.14 | 2026.1.14 |
| mcp-server-gitPyPI | v < 2026.1.14 | 2026.1.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.