git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths accessible by the process.

git-mcp-server version 2.15.1 contains an argument injection vulnerability affecting the ref and object parameters in the git_log, git_diff, and git_show tools. The vulnerability exists due to a lack of leading-dash validation on user-supplied input, allowing attackers to inject arbitrary git command-line options. By injecting options such as --output=, an attacker can write files to arbitrary paths outside the repository that are accessible by the process. The vulnerability has been addressed in version 2.15.3, where fixes were applied to the command-builder utility and log operation handling. A GitHub issue and VulnCheck advisory document the flaw and its remediation. This represents a path traversal and arbitrary file write risk in development tooling environments leveraging MCP server integrations.