Why it mattersTeams running these three servers must upgrade this week. The fixes cover path, origin and address checks.
A reference MCP filesystem server can be tricked into writing a file outside its allowed directory on Linux and macOS. The Model Context Protocol team released v2.1.0 on 25 October. The release closes eight advisories across three servers. The notes are on GitHub.
Three packages have fixes. @modelcontextprotocol/server-filesystem goes to 2.0.1 on npm. @modelcontextprotocol/server-everything goes to 2.0.1 on npm. mcp-server-fetch goes to 2026.10.24 on PyPI. The other reference servers are unchanged.
What the filesystem fixes close
Four advisories touch the filesystem server. GHSA-53mr-w429-c597 stops a swap trick between the access check and the write. A parent directory could be replaced by a symlink in that gap. That could redirect write_file, edit_file, create_directory and the move_file destination outside the allowed directories. The fix covers Linux and macOS. Windows is only partly fixed, and the advisory describes what is still exposed.
GHSA-7rgq-gccq-qphx makes the access check read a path exactly as the file operation reads it. A trailing quote or whitespace can no longer reach a sibling directory. GHSA-4gxg-m5jx-9j57 fixes a case regression from 2026.8.31. The bug was on case-insensitive volumes, such as the default macOS one. GHSA-hhwq-wxfx-cj7g makes list_directory_with_sizes check each entry before reading its size. A symlink can no longer leak size and modification time for a file outside the allowed path.
What the everything and fetch fixes close
The server-everything package fixes one advisory, GHSA-mvf5-2qqv-rg3c. Its HTTP and SSE transports now check the Origin header. They no longer send Access-Control-Allow-Origin: *. A web page the user visits can no longer call the server's tools, such as get-env, or read their replies.
The fetch server closes three advisories. GHSA-v38p-wf49-hx2j makes the address check and the connection use the same host name. The bug affected internationalized (IDNA) names and could reach an internal address. GHSA-66qx-2266-pmj6 refuses NAT64 addresses in 64:ff9b::/96 that wrap a private, loopback or link-local IPv4 address. IPv4-mapped addresses were already refused. GHSA-3jqg-r5pp-rmp2 checks robots.txt again after every redirect.
One upgrade trap
The release page warns teams on a date-versioned release. They will not see 2.0.1 offered as an upgrade. Package managers rank 2.0.1 below every 2025.x and 2026.x version. The release says to install 2.0.1 explicitly, for example npm install @modelcontextprotocol/server-filesystem@2.0.1.
A team running these servers against Claude Code, Cursor or Codex has a clear job this week. Pin the new version. Redeploy. Read the eight advisory pages for the parts that match the setup. The filesystem fix on Windows is partial. A Windows host still has configuration work after the upgrade.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.