{"action":"Upgrade @modelcontextprotocol/server-filesystem to 2025.7.1 or later.","affected":[{"introduced":"0","last_affected":"0.6.2"},{"fixed":"2025.7.1","introduced":"2025.1.14"}],"component":"@modelcontextprotocol/server-filesystem","cve_ids":["CVE-2025-53110"],"ecosystem":"npm","epss":0.0058,"exploited":false,"fixed_versions":["2025.7.1"],"ghsa_id":"GHSA-hc55-p739-j48w","id":"tcs_01M5KFTPVTHYM4CZBNAXHSD15B","modified_at":"2025-07-02T18:57:22Z","published_at":"2025-07-01T20:14:00Z","references":["https://osv.dev/vulnerability/GHSA-hc55-p739-j48w","https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-hc55-p739-j48w","https://nvd.nist.gov/vuln/detail/CVE-2025-53110","https://github.com/modelcontextprotocol/servers/commit/cc99bdabdcad93a58877c5f3ab20e21d4394423d","https://github.com/modelcontextprotocol/servers"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-hc55-p739-j48w","url":"https://osv.dev/vulnerability/GHSA-hc55-p739-j48w"},{"source":"nvd","source_id":"CVE-2025-53110","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53110"}],"summary":"@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix"}