[{"data":1,"prerenderedAt":63},["Reactive",2],{"news-story-news-20261025-mcp-reference-servers-v2-1-0-eight-vulnerabilities":3},{"id":4,"title_zh":5,"title_en":6,"summary_zh":7,"summary_en":8,"takeaways_zh":9,"takeaways_en":15,"content_zh":21,"content_en":22,"external_links":23,"source":38,"category":43,"impact_score":44,"views_count":45,"likes_count":46,"related_entities":47,"tags":55,"image_url":41},"news-20261025-mcp-reference-servers-v2-1-0-eight-vulnerabilities","MCP 官方参考服务器 v2.1.0 修复 8 个安全漏洞：filesystem、everything 升至 2.0.1，fetch 升至 2026.10.24","MCP reference servers v2.1.0 fix eight vulnerabilities: upgrade filesystem and everything to 2.0.1 and fetch to 2026.10.24","Model Context Protocol 官方 servers 仓库 10 月 25 日（UTC）发布 v2.1.0，修复三个参考服务器中的 8 个漏洞：filesystem 的符号链接竞态、路径尾随引号/空格绕过和大小写符号链接绕过，everything 的 HTTP/SSE 跨源调用，以及 fetch 的 IDNA 主机名与 NAT64 内网访问、重定向后 robots.txt 未复查。官方提醒：仍在日期版本（2025.x/2026.x）的 npm 用户不会被自动提示升级，需要显式安装 2.0.1；Windows 上的 filesystem 写入问题只部分修复。","On Oct 25 (UTC) the official Model Context Protocol servers repo shipped v2.1.0, fixing eight vulnerabilities in three reference servers: symlink races, trailing quote/whitespace path bypasses and case-insensitive symlink bypasses in filesystem; cross-origin calls over HTTP/SSE in everything; and IDNA host-name and NAT64 internal-address reachability plus robots.txt not rechecked after redirects in fetch. The maintainers warn that npm users still on date versions (2025.x/2026.x) will not be offered the upgrade and must install 2.0.1 explicitly, and that the filesystem write issue is only partly fixed on Windows.",[10,11,12,13,14],"共修复 8 个漏洞，涉及 3 个服务器（[发布说明](https://github.com/modelcontextprotocol/servers/releases/tag/v2.1.0)）","filesystem 4 个：写入符号链接竞态、尾随引号/空格绕过、大小写符号链接绕过、list_directory_with_sizes 泄露目录外文件元数据","everything 1 个：HTTP/SSE 传输不再返回 `Access-Control-Allow-Origin: *`，网页无法再调用 `get-env` 等工具","fetch 3 个：IDNA 主机名校验与连接不一致、NAT64 包裹内网 IPv4、重定向后不复查 robots.txt","日期版本 npm 用户需手动 `npm install @modelcontextprotocol/server-filesystem@2.0.1`；Windows 只部分修复",[16,17,18,19,20],"Eight vulnerabilities fixed across three servers ([release notes](https://github.com/modelcontextprotocol/servers/releases/tag/v2.1.0))","filesystem, 4 fixes: symlink race on writes, trailing quote/whitespace bypass, case-insensitive symlink bypass, list_directory_with_sizes leaking metadata outside allowed dirs","everything, 1 fix: HTTP/SSE transports no longer send `Access-Control-Allow-Origin: *`, so web pages can no longer call tools like `get-env`","fetch, 3 fixes: IDNA host-name check vs. connection mismatch, NAT64-wrapped private IPv4, robots.txt not rechecked after redirects","Date-versioned npm installs must run `npm install @modelcontextprotocol/server-filesystem@2.0.1` explicitly; Windows is only partly fixed","### 核心背景与行业痛点\nMCP 官方 servers 仓库里的 filesystem、fetch、everything 是很多人接入 Claude Code、Cursor 等客户端时最先装的参考实现，也常被直接拿来做生产 Agent 的读写文件和抓网页能力。它们一旦有边界漏洞，Agent 就可能被网页或恶意目录诱导读写允许范围之外的文件，或访问内网地址。\n\n### 架构亮点与底层机制\nv2.1.0 的修复思路是“检查什么就用什么”：filesystem 在写入时防止父目录被换成符号链接，路径校验不再剥掉尾随引号或空格，大小写不同的符号链接也会被拦下；everything 的 HTTP/SSE 传输开始校验 Origin 头，不再返回通配 CORS；fetch 让地址检查和真实连接使用同一个主机名，NAT64 地址按其内含的 IPv4 判断，每次重定向后重新检查 robots.txt。\n\n### 权威 Benchmark 与实测跑分对比\n这是安全修复版本，没有性能跑分；发布说明列出 8 个 GitHub 安全公告编号，未在说明中给出 CVSS 评分。官方明确写出 Windows 上的 filesystem 写入问题只部分修复。\n\n### 开发者实战落地与开箱指南\nTypeScript 服务器在 1.0.0 改成语义化版本，包管理器会把 2.0.1 排在所有 2025.x、2026.x 日期版本之下，所以不会自动提示升级。请显式运行 `npm install @modelcontextprotocol/server-filesystem@2.0.1`（everything 同理），Python 的 fetch 升到 `mcp-server-fetch==2026.10.24`。在 Windows 上使用 filesystem 时，先按公告说明调整配置。","### Background and pain point\nThe filesystem, fetch and everything servers in the official MCP servers repo are often the first reference implementations people wire into Claude Code, Cursor and other clients, and many agents use them directly for file access and web fetching. Boundary bugs here let a web page or a crafted directory push an agent outside its allowed files or onto internal addresses.\n\n### What changed under the hood\nv2.1.0 makes each check match what is actually used. filesystem stops a parent directory swapped for a symlink from redirecting writes, no longer strips a trailing quote or whitespace during the access check, and catches symlinks spelled in a different letter case. everything's HTTP/SSE transports now check the Origin header and drop wildcard CORS. fetch checks and connects with the same host name, judges NAT64 addresses by the IPv4 they carry, and rechecks robots.txt after every redirect.\n\n### Benchmarks\nThis is a security release with no performance numbers. The notes list eight GitHub security advisories but give no CVSS scores, and state that the filesystem write issue is only partly fixed on Windows.\n\n### How to upgrade\nThe TypeScript servers switched to semantic versions in 1.0.0, so package managers rank 2.0.1 below every 2025.x and 2026.x date version and will not offer it. Run `npm install @modelcontextprotocol/server-filesystem@2.0.1` explicitly (same for everything), and upgrade Python fetch to `mcp-server-fetch==2026.10.24`. On Windows, follow the advisory's configuration guidance.",[24,28,31,34],{"title":25,"url":26,"type":27},"MCP servers v2.1.0 release notes","https://github.com/modelcontextprotocol/servers/releases/tag/v2.1.0","github",{"title":29,"url":30,"type":27},"GHSA-53mr-w429-c597 (filesystem symlink write race)","https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-53mr-w429-c597",{"title":32,"url":33,"type":27},"GHSA-mvf5-2qqv-rg3c (everything cross-origin)","https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-mvf5-2qqv-rg3c",{"title":35,"url":36,"type":37},"mcp-server-fetch on PyPI","https://pypi.org/project/mcp-server-fetch/","docs",{"platform":27,"author_name":39,"author_handle":40,"author_avatar":41,"tweet_url":41,"published_at":42},"Model Context Protocol","modelcontextprotocol","","2026-10-25T00:03:20Z","tooling",82,43,0,{"models":48,"agents":49,"vendors":53},[],[50,51,52],"Claude Code","Cursor","Codex",[54,39],"Anthropic",[56,57,58,59,60,61,62],"MCP","security","filesystem","fetch","SSRF","symlink","CORS",1793718872903]