{
 "id": "AIR-2026-0976",
 "slug": "cve-2026-27735-path-traversal-vulnerability-in-model-context",
 "title": "CVE-2026-27735: Path traversal vulnerability in Model Context Protocol git server",
 "summary": "The Model Context Protocol git server tool failed to validate file paths within repository boundaries, allowing path traversal using relative sequences. Users have been advised to upgrade to version 2026.1.14 or newer.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "mcp-server-git"
 ],
 "incident_date": "2026-02-26",
 "incident_date_precision": "day",
 "first_reported": "2026-02-26",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27735",
   "publisher": "NVD",
   "title": "CVE-2026-27735: Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP).",
   "published_at": "2026-02-26"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-27735",
  "mcp",
  "path-traversal"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}