{ "entry": { "kind": "vuln", "slug": "ghsa-53mr-w429-c597", "name": "GHSA-53mr-w429-c597", "vendor": "@modelcontextprotocol/server-filesystem", "description": "The modelcontextprotocol/servers repository released v2.1.0 on 25 October 2026 (00:03 UTC), fixing eight advisories in three reference servers. @modelcontextprotocol/server-filesystem 2.0.1 fixes four path-handling bugs: GHSA-53mr-w429-c597, a race in which a parent directory swapped for a symlink between the access check and the write redirected write_file, edit_file, create_directory or the move_file destination outside the allowed directories (only partly fixed on Windows); GHSA-7rgq-gccq-qphx, where the check stripped a trailing quote or whitespace that the file operation kept, reaching a sibling directory; GHSA-4gxg-m5jx-9j57, a 2026.8.31 regression in which a symlink spelled in a different letter case passed the check on case-insensitive volumes such as macOS's default; and GHSA-hhwq-wxfx-cj7g, where list_directory_with_sizes revealed the size and modification time of files outside the allowed tree. @modelcontextprotocol/server-everything 2.0.1 (GHSA-mvf5-2qqv-rg3c) stops sending Access-Control-Allow-Origin: * on its HTTP and SSE transports, which let any web page call its tools, including get-env, and read the results. mcp-server-fetch 2026.10.24 fixes an IDNA host-name check mismatch, NAT64 addresses that wrapped private IPv4 addresses, and robots.txt not being rechecked after redirects. The release notes warn that package managers rank 2.0.1 below every date version, so installs on 2026.8.31 will not be offered the fix. Separately, Basic Memory published GHSA-4gfv-c2mm-mvj2 on 23 October (CVSS 4.0 7.7): its MCP server over SSE has no authentication, and because it never enabled FastMCP's Host and Origin guard, a web page could use DNS rebinding against a server bound to 127.0.0.1 to search, read, write and delete the user's notes; fixed in 0.24.0.", "website": "https://github.com/modelcontextprotocol/servers/releases/tag/v2.1.0", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "@modelcontextprotocol/server-filesystem", "command": null }, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-10-25", "risk": { "score": 77, "band": "high", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "GHSA-53mr-w429-c597", "aliases": [ "ti-165" ], "title": "MCP Reference Servers v2.1.0 Fix Eight Advisories, Including a Write That Escaped allowedDirectories in server-filesystem; Basic Memory's SSE Transport Was Reachable by Any Web Page Through DNS Rebinding (CVSS 7.7)", "summary": "The modelcontextprotocol/servers repository released v2.1.0 on 25 October 2026 (00:03 UTC), fixing eight advisories in three reference servers. @modelcontextprotocol/server-filesystem 2.0.1 fixes four path-handling bugs: GHSA-53mr-w429-c597, a race in which a parent directory swapped for a symlink between the access check and the write redirected write_file, edit_file, create_directory or the move_file destination outside the allowed directories (only partly fixed on Windows); GHSA-7rgq-gccq-qphx, where the check stripped a trailing quote or whitespace that the file operation kept, reaching a sibling directory; GHSA-4gxg-m5jx-9j57, a 2026.8.31 regression in which a symlink spelled in a different letter case passed the check on case-insensitive volumes such as macOS's default; and GHSA-hhwq-wxfx-cj7g, where list_directory_with_sizes revealed the size and modification time of files outside the allowed tree. @modelcontextprotocol/server-everything 2.0.1 (GHSA-mvf5-2qqv-rg3c) stops sending Access-Control-Allow-Origin: * on its HTTP and SSE transports, which let any web page call its tools, including get-env, and read the results. mcp-server-fetch 2026.10.24 fixes an IDNA host-name check mismatch, NAT64 addresses that wrapped private IPv4 addresses, and robots.txt not being rechecked after redirects. The release notes warn that package managers rank 2.0.1 below every date version, so installs on 2026.8.31 will not be offered the fix. Separately, Basic Memory published GHSA-4gfv-c2mm-mvj2 on 23 October (CVSS 4.0 7.7): its MCP server over SSE has no authentication, and because it never enabled FastMCP's Host and Origin guard, a web page could use DNS rebinding against a server bound to 127.0.0.1 to search, read, write and delete the user's notes; fixed in 0.24.0.", "severity": "high", "cvss": { "score": 7.7, "vector": null, "version": null }, "cwe": [], "attackType": [ "Authentication bypass", "Server-side request forgery", "Path traversal" ], "componentType": "mcp-server", "component": { "name": "@modelcontextprotocol/server-filesystem", "vendor": null, "package": "@modelcontextprotocol/server-filesystem", "ecosystem": null, "catalogSlug": "mcp/filesystem" }, "affected": [ { "range": ">=1.0.0 <2.0.1 || >=2024.0.0 <=2026.8.31", "fixed": "2026.10.24" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-10-25", "modifiedAt": "2026-10-25", "lastVerified": "2026-11-01", "references": [ { "type": "article", "url": "https://github.com/modelcontextprotocol/servers/releases/tag/v2.1.0" }, { "type": "advisory", "url": "https://github.com/advisories/GHSA-53mr-w429-c597" } ], "mitigation": "Install @modelcontextprotocol/server-filesystem@2.0.1 and @modelcontextprotocol/server-everything@2.0.1 explicitly, because npm will not offer 2.0.1 as an upgrade from a date version, and pin that version in the args of every MCP client config that launches the servers through npx. Upgrade mcp-server-fetch to 2026.10.24 and basic-memory to 0.24.0 or later, then restart the MCP clients so the old server processes exit. Give the filesystem server one project directory rather than the home directory, run local servers over stdio where the client supports it, and never expose server-everything or an SSE/HTTP transport without authentication and Host/Origin checks.", "detectedByAnomity": true } } }