MCP server CVE index

LAST UPDATED 2026-08-10

A consolidated, dated list of publicly disclosed CVEs affecting Model Context Protocol servers and related client tooling. There is no single index for this today — each entry below links to its real, official source (GitHub's Security Advisory Database, which mirrors NVD), not a claim aimcplist is making on its own.

What this is, and isn't. Every row below is an already-public disclosure — reported, assigned a CVE ID, and fixed by the maintainer, independent of aimcplist. This is a reference index, not aimcplist's own security research; aimcplist's own measured grading (a separate, scanner-driven process) is described on the methodology page.

CVE	Package	Severity	Published	Fixed in	Source
CVE-2026-0755 Command injection and file exfiltration in gemini-mcp-tool	gemini-mcp-tool (npm) 1.1.2 – 1.1.5	Critical · 9.8	2026-01-08	1.1.6	Snyk / GitHub Advisory Database
CVE-2025-68145 / 68144 / 68143 Path traversal and argument-injection chain in Anthropic's mcp-server-git	mcp-server-git (Anthropic reference server) Before 2025.12.18 (68143 fixed earlier, in 2025.9.25)	High · 8.6	2026-01-21	2025.12.18	The Hacker News, citing Anthropic's disclosure
CVE-2025-6514 OS command injection in mcp-remote	mcp-remote (npm) 0.0.5 – 0.1.15	Critical · 9.6	2025-07-09	0.1.16	GitHub Advisory Database (discovered by JFrog Security Research)
CVE-2025-49596 Unauthenticated remote code execution in Anthropic's MCP Inspector	@modelcontextprotocol/inspector (npm) Before 0.14.1	Critical · 9.4	2025-06-01	0.14.1	GitHub Advisory Database

CVE-2026-0755 — Command injection and file exfiltration in gemini-mcp-tool

Improper validation of user-supplied strings passed to execAsync allowed arbitrary OS command execution with no authentication and no user interaction required. A related flaw let untrusted prompt input reach the Gemini CLI's @file parser, exfiltrating arbitrary local files; on Windows, unquoted cmd.exe metacharacters allowed a second command-injection path.

CVE-2025-68145 / 68144 / 68143 — Path traversal and argument-injection chain in Anthropic's mcp-server-git

Three chained flaws in Anthropic's own official Git MCP server: git_init accepted arbitrary filesystem paths without validation (turning any directory into a git repo), git_diff/git_checkout passed user-controlled arguments straight to the git CLI unsanitized, and a missing --repository path check allowed escaping the intended repository boundary. Exploitable via prompt injection — a malicious README or poisoned issue an AI assistant reads, not direct system access — to overwrite files or exfiltrate credentials from other repositories on the same host.

CVE-2025-6514 — OS command injection in mcp-remote

mcp-remote's sanitizeUrlz function passed a connected MCP server's authorization_endpoint response to an OS command without sanitizing it first. A malicious or compromised MCP server could return a crafted authorization endpoint value that executes arbitrary system commands on the client's machine — full compromise of anyone who connects to an untrusted server through this proxy.

CVE-2025-49596 — Unauthenticated remote code execution in Anthropic's MCP Inspector

The Inspector's local proxy accepted stdio commands from its browser client with no authentication check. Simply visiting a malicious website while MCP Inspector was running locally was enough to trigger arbitrary code execution on the developer's machine — a drive-by attack against a developer debugging tool, not something requiring the target to install anything extra.