servers v2.4.0

Release v2.4.0 of the Model Context Protocol reference servers, the small programs that give an AI assistant tools such as file access, git and web fetching, fixes six vulnerabilities in three servers, and one of them matters more than the rest: in `mcp-server-git`, asking for the status of an untrusted repository could run a program chosen by whoever prepared that repository (release notes). Its advisory is rated high, with a CVSS score of 7.8. The other five are rated moderate or low, and none of the six advisories lists a CVE. The fixes are in `mcp-server-git` and `mcp-server-fetch` 2026.11.11 and `@modelcontextprotocol/server-filesystem` 2.3.0, and anyone still on a date-versioned filesystem release has to request that upgrade by name.

Git lets a repository's own `.git/config` file name programs to run during ordinary commands. `core.fsmonitor` names a helper Git asks which files have changed, so a plain `git status` launches it; `diff.external` names a program that produces diffs; hooks, filter and merge drivers and commit signing work the same way. The git server ran Git with those settings in force, so a read-only tool call such as `git_status` executed whatever the repository named, with the server's privileges. According to the advisory, the attacker has to get a repository to the user with its own `.git` directory intact, through a copied workspace, archive or shared folder, since a plain `git clone` does not copy the original `.git/config` and GitHub's source ZIP leaves out `.git`, and the server then has to be pointed at it. After that the code runs inside Git rather than through the assistant's own command tool, so confirmation dialogs and tool sandboxes do not catch it, and it can reach the server's environment, including credentials passed to it. Version 2026.11.11 overrides those settings on every Git command and refuses a Git older than 2.31, which would ignore the overrides. The advisory lists no workaround other than upgrading; until then, point the server only at repositories whose `.git` directory you trust.

The second git fix is a hole in an earlier one. Release v2.2.0 closed a way around the `--repository` option, which is meant to confine the server to one repository, by stopping a `.git` file inside the allowed repository from redirecting Git elsewhere. The new advisory, rated moderate, calls that fix incomplete: an attacker who can write plain text files inside the allowed repository could use `objects/info/alternates`, a file that tells Git to borrow objects from another repository's store, to read that repository's history, or pass off a linked worktree's Git directory as the allowed one. It affects versions from 2026.10.28, the release that carried the earlier fix. Version 2026.11.11 refuses both and refuses symlinks in a Git directory that lead outside, but the notes say a Windows directory junction is not yet covered, and the advisory warns Windows users not to rely on `--repository` against a client that can create junctions.

The filesystem fixes close two time-of-check-to-time-of-use races, where the server checks that a path is inside its allowed directories and then acts on it, and a local process swaps a directory for a symlink in between. One let reads return a file from outside (GHSA-p9cv-8g75-4xcg); the other let `move_file` pull an outside file into the allowed directories, where it could then be read (GHSA-7m4x-rv66-mxhh). Both are rated moderate and need a process that can rename directories inside the allowed area and win the timing; on Windows the read fix narrows the race without closing it. The two low-rated fetch fixes stop the private-address guard treating IPv6 site-local addresses (`fec0::/10`) as public, which its advisory calls a defense-in-depth gap, and stop alternate path spellings such as `//private` slipping past robots.txt rules. Anyone on an old date version of the filesystem server, such as 2026.8.31, has to run `npm install @modelcontextprotocol/server-filesystem@2.3.0`: the TypeScript servers switched to semantic versions at 1.0.0, and because versions are compared number by number, 2 sorts below 2026, so package managers never offer 2.3.0 as an upgrade.