Three vulnerabilities in Anthropic's mcp-server-git package: 1) Path traversal in git_init tool accepting arbitrary file paths without validation, 2) Argument injection in git_diff and git_checkout functions passing user-controlled arguments directly to git CLI commands, 3) Path traversal due to missing path validation with --repository flag. Vulnerabilities can be exploited through prompt injection and chained with Filesystem MCP server to write malicious .git/config files and achieve remote code execution by creating repos, writing malicious configs with clean filters, .gitattributes files, shell scripts, and triggering execution via git_add.