If you run the MCP filesystem, everything, or fetch servers, older versions allow writes outside allowed directories via symlink races and path-check bypasses. Upgrade to 2.0.1 (filesystem, everything) and 2026.10.24 (fetch).
Key takeaways · AI-distilled
Users on date-versioned npm releases must upgrade by hand: the TypeScript servers switched to semantic versions in 1.0.0, so package managers rank 2.0.1 below every 2025.x and 2026.x version and will not offer it. The notes say to install @2.0.1 explicitly.
Before 2.0.1, server-everything's HTTP and SSE transports sent Access-Control-Allow-Origin: * without checking the Origin header, so any web page the user visited could call its tools, such as get-env, and read the results. It now checks Origin.
MCPThe Model Context Protocol — an open standard that lets any AI assistant plug into any tool or data source without custom integration code.Full definition →-server-fetch checked one form of an internationalized (IDNA) host name but connected to another, which could reach an internal address. It now also refuses NAT64 addresses wrapping private, loopback or link-local IPv4, and rechecks robots.txt after every redirect.
server-filesystem's access check stripped a trailing quote or whitespace that the file operation kept, so a sibling directory named after an allowed one plus that suffix was reachable. 2.0.1 checks paths exactly as they are used.
In server-filesystem, list_directory_with_sizes now checks each entry before reading its size, so a symlink inside an allowed directory no longer reveals the size and modification time of a file outside it.
Terms in this piece · Glossary
MCP — The Model Context Protocol — an open standard that lets any AI assistant plug into any tool or data source without custom integration code.
