GHSA-6hqx-gqrx-c5r2Git configuration can run code
A client must direct a Git tool to a repository with attacker-controlled local configuration. Even status can execute a program with the MCP server account.
MCP reference servers fix Git code execution and access boundary flaws
MCP reference release v2.4.0 fixes six issues across Git, Filesystem and Fetch. An untrusted Git repository can make a read-only tool run code with server privileges. Filesystem protections still have Windows limits.
- Disclosed
- Nov 11, 2026
- Public disclosure date
- Severity
- Sharted
- 6 CVEs tracked here
- Splash zone
- Installations of the affected MCP reference servers, particularly Git tools pointed at untrusted repositories.
- MCP · Git · Filesystem · Fetch
- In the wild
- Unknown
What happened
The Git configuration issue lets an untrusted repository trigger program execution when an older server runs a status or diff tool inside it. The update overrides program-launching settings and refuses Git versions older than 2.31. A separate Git confinement fix covers alternate object stores and linked worktrees. Windows directory junctions remain a path around that confinement.
Both Filesystem issues require a local directory swap and a successful race. The release identifies Filesystem versions before 2.3.0, including date releases 2025.1.14 through 2026.8.31, as affected. The maintainers say the Windows read race was narrowed and remains possible. The Fetch fixes cover address classification and crawler policy. Bypassing robots.txt does not bypass origin authentication. The advisories document reproduction details without reporting confirmed attacks. The reproducible Git code execution path warrants L3.
What’s in the bowl
GHSA-q74p-4wrc-q7w6Git repository boundary escape
A crafted Git directory, alternate object store or linked worktree can redirect access outside the configured repository. Windows directory junctions remain a limitation.
GHSA-p9cv-8g75-4xcgFilesystem read race
A local process that can swap a checked parent directory for a symlink can race a read and expose a file outside the allowed roots.
GHSA-7m4x-rv66-mxhhFilesystem move race
A local process that can swap the checked source directory during a same-device move can redirect which file gets moved into the allowed tree.
GHSA-3rxj-6jhw-qfv7Fetch private-address guard gap
A deprecated IPv6 site-local address can pass the public-address check. Impact depends on routing from the server.
GHSA-f9hh-cmx9-2f23Fetch crawler rule bypass
An alternate spelling of a path can evade robots.txt checks when the origin normalizes that path before serving it.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| mcp-server-git | 2026.11.11 | |
| mcp-server-fetch | 2026.11.11 | |
| @modelcontextprotocol/server-filesystem | 2.3.0 |
Crime-scene timeline
Nov 11, 2026
Maintainers disclose six advisories and ship fixes
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- MCP reference server v2.4.0 releasePrimary
- GHSA-6hqx-gqrx-c5r2Primary
- GHSA-q74p-4wrc-q7w6Primary
- GHSA-p9cv-8g75-4xcgPrimary
- GHSA-7m4x-rv66-mxhhPrimary
- GHSA-3rxj-6jhw-qfv7Primary
- GHSA-f9hh-cmx9-2f23Primary