MCP patches six vulnerabilities in its filesystem, git, and fetch servers

The Model Context Protocol project published the servers v2.4.0 release on November 11, 2026, patching six security advisories across its official filesystem, git, and fetch reference servers, including a high-severity remote command execution bug in the git server.

What changed

• Six security advisories were published together with the servers v2.4.0 release on November 11, 2026.
• The most severe issue, the GHSA-6hqx-gqrx-c5r2 advisory (CVSS 7.0), let mcp-server-git execute attacker-controlled programs through .git/config keys such as core.fsmonitor, diff.external, and core.hooksPath, even when an agent only called the read-only git_status tool.
• A second git advisory, GHSA-q74p-4wrc-q7w6 (CVSS 5.3), was an incomplete-fix follow-up that closed object-store and linked-worktree confinement bypasses.
• server-filesystem had two time-of-check-time-of-use symlink race conditions, one in the read_text_file symlink race advisory (CVSS 4.4) and one in move_file (CVSS 5.3), both allowing file access outside the configured allowed directories.
• mcp-server-fetch misclassified the deprecated IPv6 site-local ranges fec0::/10 and ::ffff:0:0/96 as public, an SSRF gap rated CVSS 3.1.
• mcp-server-fetch also had a robots.txt bypass triggered by unnormalized paths such as //private or %2e%2e, rated CVSS 3.1.

Why this matters for AI builders

These reference servers are the starting point many AI coding agents and MCP clients build on, so a flaw triggerable by a supposedly read-only git_status call is a realistic supply-chain risk for anyone running agentic coding tools against untrusted repositories.

Patched versions and advisory status

• Patched releases: @modelcontextprotocol/server-filesystem 2.3.0, mcp-server-git 2026.11.11, and mcp-server-fetch 2026.11.11.
• None of the six issues received a CVE ID as of publication; all are tracked only as GHSA advisories, with fixes merged through pull requests #5514, #5515, #5517, and #5518 in the modelcontextprotocol/servers repository.

Sources

• servers v2.4.0 (Model Context Protocol (GitHub), November 11, 2026, official)
• mcp-server-git arbitrary command execution via git config (GitHub Security Advisories, November 11, 2026, official)
• server-filesystem TOCTOU symlink race in read_text_file (GitHub Security Advisories, November 11, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.