model_context_protocol_servers vulnerabilities
CVEs whose affected-version data names the model_context_protocol_servers package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2025-68145Critical· 9.1In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actual…
In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actual…
▾ Midnightlfprojects · model_context_protocol_serversEPSS 7.0%via NVD
CVE-2025-68143High· 8.8Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP)
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git reposi…
▾ Twilightlfprojects · model_context_protocol_serversEPSS 8.1%via NVD