MCP reference servers v2.4.0 fixes six vulnerabilities across three servers: Reveneau

Why it mattersAn older filesystem, git or fetch server can be used to read files outside its allowed folders. It can also be used to run code from a repository.

If your coding agent uses a Model Context Protocol reference server, it needs an upgrade today. Six security advisories were published with v2.4.0. Two sit in each of three servers: filesystem, git and fetch.

The release note names each advisory and the fixed version. @modelcontextprotocol/server-filesystem moves to 2.3.0. Both mcp-server-git and mcp-server-fetch move to the date version 2026.11.11. All versions before those are listed as affected.

What the filesystem server got wrong

Two advisories against the filesystem server share the same idea. An attacker swaps a folder for a symbolic link. The swap happens between the moment the server checks the folder and the moment it reads or writes.

On the read path, GHSA-p9cv-8g75-4xcg could expose files outside the allowed folders. On the move_file call, GHSA-7m4x-rv66-mxhh could bring an outside file into an allowed folder. The server would then open it like any other.

The fix changes the order of work. The server now acts on the same file it checked, under a fresh name, before the swap can happen.

What the git server got wrong

The git server has two separate problems. GHSA-6hqx-gqrx-c5r2 describes a repository whose .git/config sets hooks or filter drivers. Those then run arbitrary programs on the host when the server reads the repository. GHSA-q74p-4wrc-q7w6 uses alternate object stores or linked worktrees. These step outside the repository the server was told to read.

What the fetch server got wrong

mcp-server-fetch gives an agent a way to pull web pages. GHSA-3rxj-6jhw-qfv7 counted IPv6 site-local addresses as public. That let a fetch reach a private network from inside a company. GHSA-f9hh-cmx9-2f23 showed a way around robots.txt restrictions through path normalization. A site that told the fetcher to stay away could still be read.

What to do

A project that pins a version in the listed ranges needs a fresh install, not a plain version bump. The release note gives the exact pins. Each advisory on the GitHub security tab records the pull request that fixes it. Each also names the person who reported the fault.

Teams running an agent with these tools should also look at what each tool lets the model reach. Each of the six faults needed an attacker to supply content the server was willing to open: a folder the agent chases, a repository the agent clones, a URL the agent fetches.

Source

MCP reference servers v2.4.0 release note, with links to each of the six GitHub Security Advisories.

This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.