# We run the official MCP reference servers from the modelcontextprotocol/servers repo (git, filesystem, fetch, everything) with our coding agent. Which versions have known vulnerabilities, which versions fix them, and is it enough to upgrade?

**Short answer:** As of November 10, 2026, run the latest releases: mcp-server-git 2026.11.4 and mcp-server-fetch 2026.11.4 on PyPI, and @modelcontextprotocol/server-filesystem 2.2.0 and @modelcontextprotocol/server-everything 2.2.1 on npm. The minimum fixed versions for the published advisories are mcp-server-git 2026.10.28 (a nested .git file could escape --repository confinement), mcp-server-fetch 2026.10.24 (robots.txt skipped on redirects, plus two bypasses of the private-address guard) and 2.0.1 for the two npm packages (four filesystem path-confinement bugs and an everything-server environment-variable leak). Two traps: the npm packages moved from date versions back to semantic versions at 1.0.0 in October 2026, so a pin like 2026.8.31 looks newer than 2.0.1 but is older, unpatched and deprecated; and the fixes for these advisories went only into 2.0.1, with no patched date-based version. Upgrading closes known bugs but doesn't make these servers a security boundary: the repository README calls them reference implementations meant as educational examples, not production-ready solutions, and most of the bugs were reachable by prompt injection, because the model chooses the paths and URLs.

## Checklist
1. Find what you actually run: check each MCP client config for npx, uvx, pip or Docker entries that start mcp-server-git, mcp-server-fetch, @modelcontextprotocol/server-filesystem or @modelcontextprotocol/server-everything, and note the version each one resolves to.
2. Upgrade mcp-server-git to 2026.10.28 or later (latest 2026.11.4) and mcp-server-fetch to 2026.10.24 or later (latest 2026.11.4).
3. Upgrade the npm servers to 2.0.1 or later (filesystem latest 2.2.0, everything latest 2.2.1). Replace any date-based pin such as 2026.8.31: those versions are deprecated and none of them carries the October 2026 fixes.
4. Pin the exact version you reviewed rather than using latest, and re-read the advisories page before each upgrade.
5. Start the git server with --repository for the one repository the agent needs, and the filesystem server with only the directories it needs; add --read-only to the filesystem server when the task only reads.
6. Don't give a filesystem server write access to a directory that a confined git server also serves: the nested .git file advisory names that combination as a realistic way to plant the redirect.
7. Keep mcp-server-fetch's default private-address guard on (don't pass --allow-private-ips), and add --allowed-hosts when the agent only needs a few sites.
8. Never run the everything server outside a test machine, and never with GET_ENV_INCLUDE_SECRETS set.
9. Run these servers inside an OS sandbox or container with only the files and network they need, because confinement inside the server has been bypassed several times.

## Which vulnerabilities affect the official MCP git, filesystem, fetch and everything servers, and which versions fix them?
- mcp-server-git: CVE-2025-68143 (the git_init tool could create a repository anywhere; fixed in 2025.9.25 by removing the tool), CVE-2025-68144 (argument injection in git_diff and git_checkout, for example a --output flag passed as a ref, could overwrite files) and CVE-2025-68145 (repo_path wasn't checked against --repository), both fixed in 2025.12.18. CVE-2026-27735 (git_add staged files outside the repository via ../ paths) was fixed in 2026.1.14. On October 28, 2026 a further advisory (GHSA-w766-5x43-whvw, CVSS 3.1 5.3) showed that a directory inside the allowed repository holding a .git file with a gitdir: line pointing elsewhere let tool calls read and change another repository; it's fixed in 2026.10.28.
- @modelcontextprotocol/server-filesystem: the 2025 symlink and prefix-collision bypasses (CVE-2025-53109 and CVE-2025-53110) were fixed in mid-2025. Four more advisories published on October 25, 2026 (UTC) are fixed in 2.0.1: a case-variant symlink name on case-insensitive file systems such as macOS and Windows defaults (a regression in 2026.8.31, 1.0.0 and 2.0.0), a trailing quote or whitespace that passed the check but opened a sibling directory, a race on the parent directory when creating files, and list_directory_with_sizes leaking the size of files outside the allowed directories through symlinks.
- mcp-server-fetch: three advisories published on October 25, 2026 (UTC) are fixed in 2026.10.24. robots.txt was checked only for the first URL, so a redirect could reach a disallowed page; and the private-address guard added in 2026.10.10 could be bypassed with internationalized host names (the check and the connection resolved different names) and, on NAT64 networks, with the 64:ff9b::/96 prefix that can route to a cloud metadata address.
- @modelcontextprotocol/server-everything: its HTTP transports listened on all interfaces with wildcard CORS and no authentication while a get-env tool returned the whole environment, so any web page in the browser could read the server's secrets (GHSA-mvf5-2qqv-rg3c, CVSS 3.1 6.5). It's fixed in 2.0.1; the README now says browser requests are accepted only from a localhost Origin and credential-like variables are masked unless GET_ENV_INCLUDE_SECRETS is set.

## Why is @modelcontextprotocol/server-filesystem 2026.8.31 older than 2.0.1?
- The npm reference servers were published with date versions (2025.1.14 through 2026.8.31) and then resumed semantic versioning at 1.0.0 on October 11, 2026. Every date-based version is now deprecated on npm with the message that date-based versions are no longer published. The October 2026 filesystem and everything advisories list no patched date-based version; the fix is 2.0.1. A version check that compares numbers will rank 2026.8.31 above 2.0.1, so check against the advisory ranges, not by which number is bigger.
- The Python servers kept date versions. mcp-server-git and mcp-server-fetch both released 2026.10.10, 2026.10.19 and 2026.11.4; the fetch fix shipped as 2026.10.24 and the git fix as 2026.10.28. If you start them with uvx and no version, you get whatever is latest when the cache refreshes, which is fine for fixes but means a reviewed version can change under you.

## Are the official MCP reference servers safe to use in production?
- The repository README warns that these servers are reference implementations meant to demonstrate MCP features and SDK usage, not production-ready solutions, and that you should apply safeguards for your own threat model. Most of the advisories are path or address checks that were bypassed with an unusual input, and the model supplies those inputs. The security firm that reported the 2025 git flaws (Cyata) showed they could be triggered through prompt injection, such as a poisoned README or issue the assistant reads, and chained with the filesystem server writing a .git/config to run code.
- So treat the server's own confinement as one layer. Give each server the narrowest directory, repository and host list it needs, prefer read-only modes, run it in a sandbox the model can't change, and require a person to approve writes, commits and pushes that came out of a task where the agent read untrusted content.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Before you run git_commit or git_push through the git MCP server in this task, ask me to approve the exact tool name and arguments, and wait for my yes or no."

```json
{
  "tool": "request_human_approval",
  "arguments": {
    "action": {
      "tool": "git_push",
      "arguments": "<the exact arguments object you will send>"
    },
    "summary": "Push the agent's commit on branch fix-readme to origin (task read an external issue).",
    "expires_in_minutes": 30
  }
}
```
- Needs your API key. The action is hashed, and you decide once with decide_human_approval (approve or deny); the decision is a signed, timestamped receipt, and verify_human_approval (free) checks that a later call matches what was approved.
- Rightshold doesn't check which version of a reference server you run, doesn't read the GitHub advisories for you and can't stop a server process from touching files; the approval only works if your client or wrapper waits for it before making the call.

_Rightshold records approvals and actions for AI agents. It isn't affiliated with the MCP project or the reference servers and doesn't scan local installs. Advisory details and version numbers are from the modelcontextprotocol/servers security advisories, PyPI and npm as checked on November 10, 2026; new advisories may have been published since._

## Sources
- [modelcontextprotocol/servers: Security advisories](https://github.com/modelcontextprotocol/servers/security/advisories)
- [GitHub Advisory: mcp-server-git nested gitdir file bypasses --repository confinement (GHSA-w766-5x43-whvw)](https://github.com/advisories/GHSA-w766-5x43-whvw)
- [GitHub Advisory: CVE-2025-68144, argument injection in git_diff and git_checkout](https://github.com/advisories/GHSA-9xwc-hfwc-8w59)
- [GitHub Advisory: CVE-2025-68145, missing path validation with --repository](https://github.com/advisories/GHSA-j22h-9j4x-23w5)
- [GitHub Advisory: CVE-2025-68143, unrestricted git_init](https://github.com/advisories/GHSA-5cgr-j3jf-jw3v)
- [GitHub Advisory: server-everything cross-origin environment variable exfiltration (GHSA-mvf5-2qqv-rg3c)](https://github.com/advisories/GHSA-mvf5-2qqv-rg3c)
- [modelcontextprotocol/servers README (reference implementations warning)](https://github.com/modelcontextprotocol/servers)
- [mcp-server-git on PyPI](https://pypi.org/project/mcp-server-git/)
- [mcp-server-fetch on PyPI](https://pypi.org/project/mcp-server-fetch/)
- [@modelcontextprotocol/server-filesystem on npm](https://www.npmjs.com/package/@modelcontextprotocol/server-filesystem)
- [SecurityWeek: Anthropic MCP Server Flaws Lead to Code Execution, Data Exposure](https://www.securityweek.com/anthropic-mcp-server-flaws-lead-to-code-execution-data-exposure/)

## Related
- [How to sandbox a local stdio MCP server to only the files and hosts it needs](https://www.rightshold.com/answers/how-to-sandbox-a-local-stdio-mcp-server-to-only-the-files-and-hosts-it-needs)
- [How to pin MCP server versions and review changes before upgrading](https://www.rightshold.com/answers/how-to-pin-mcp-server-versions-and-review-changes-before-upgrading)
- [Which MCP Inspector version is safe to run?](https://www.rightshold.com/answers/which-mcp-inspector-version-is-safe-to-run-cve-2025-49596-and-later-advisories)
- [How to stop prompt injection in fetched web or file content from triggering MCP write tools](https://www.rightshold.com/answers/how-to-stop-prompt-injection-in-fetched-web-or-file-content-from-triggering-mcp-write-tools)

_Not legal advice. Updated 2026-11-10. JSON: https://www.rightshold.com/answers/which-versions-of-the-official-mcp-git-filesystem-and-fetch-servers-are-safe-to-run.json_