@modelcontextprotocol/server-filesystem has 4 advisories. Fixed in 2.0.1.

npm

Versions

Red: affected by at least one advisory. White: safe.

2.x
safe 2.0.1
AffectedSafe

Details

Safe
2.0.1
Advisories
4 in 120 days

Used by

Stacks that pull this package.

Not part of a tracked stack.

Alerts(4)

@modelcontextprotocol/server-filesystem list_directory_with_sizes follows symlinks and leaks outside-directory file metadata

@modelcontextprotocol/server-filesystem · 25 Oct

Low
Exploitable only if · read by Claude, the source remains the reference
  • Project runs @modelcontextprotocol/server-filesystem on a vulnerable version (e.g. 2026.1.14 or another date-versioned release; fixed in 2.0.1).
  • The server is configured with an allowed directory.
  • A symlink exists inside the allowed directory pointing to a file outside the allowed directory.
  • An attacker can influence the list_directory_with_sizes tool call, directly or via prompt injection or repository content read by an agent.
Affected
@modelcontextprotocol/server-filesystem >=2025.7.1 <=2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-hhwq-wxfx-cj7g
Open the alert

Parent-Directory Fallback TOCTOU in @modelcontextprotocol/server-filesystem Permits Arbitrary File Write Outside allowedDirectories

@modelcontextprotocol/server-filesystem · 25 Oct

Low
Exploitable only if · read by Claude, the source remains the reference
  • Project uses @modelcontextprotocol/server-filesystem (versions including the 2025.7.1 fixes, where validatePath returns the un-canonicalised path on the ENOENT fallback).
  • The server exposes write_file, edit_file, create_directory, or move_file tool calls that create a not-yet-existing path inside an allowed directory.
  • A separate local process running as the same user can replace a parent directory inside allowedDirectories with a symlink pointing outside the allowed tree during the race window.
Affected
@modelcontextprotocol/server-filesystem >=2025.1.14 <=2026.8.31 · @modelcontextprotocol/server-filesystem <2.0.1
Fixed in
2.0.1
ID
GHSA-53mr-w429-c597
Open the alert

Path traversal via trailing quote/whitespace in validatePath (Check/Use Mismatch)

@modelcontextprotocol/server-filesystem · 25 Oct

Medium
Exploitable only if · read by Claude, the source remains the reference
  • Project runs the @modelcontextprotocol/server-filesystem MCP server at a version before 2.0.1 (including date-versioned 2025.x/2026.x releases).
  • Server is configured with allowed directories intended to sandbox filesystem tool access.
  • An attacker can influence the path arguments of the server's filesystem tools (e.g. via prompt injection in content the LLM reads).
  • A sibling path exists (or can be created via the write tools) named like an allowed directory plus a trailing quote or whitespace character.
Affected
@modelcontextprotocol/server-filesystem >=2025.8.21 <=2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-7rgq-gccq-qphx
Open the alert

Case-variant path bypasses symlink check and allows creating files outside allowed directories in server-filesystem

@modelcontextprotocol/server-filesystem · 25 Oct

Medium
Exploitable only if · read by Claude, the source remains the reference
  • Uses @modelcontextprotocol/server-filesystem version 2026.8.31, 1.0.0 or 2.0.0.
  • The allowed directories reside on a case-insensitive file system (e.g. macOS APFS or Windows NTFS defaults, or a case-folded mount).
  • An allowed directory contains a symlink that points outside the allowed directories.
  • A client can call create directory, write file, or move file (destination) with a path that spells a component with different letter case.
Affected
@modelcontextprotocol/server-filesystem 2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-4gxg-m5jx-9j57
Open the alert