{"action":"Upgrade @modelcontextprotocol/server-filesystem to 2025.7.1 or later.","affected":[{"introduced":"0","last_affected":"0.6.2"},{"fixed":"2025.7.1","introduced":"2025.1.14"}],"component":"@modelcontextprotocol/server-filesystem","cve_ids":["CVE-2025-53109"],"ecosystem":"npm","epss":0.00765,"exploited":false,"fixed_versions":["2025.7.1"],"ghsa_id":"GHSA-q66q-fx2p-7w4m","id":"tcs_01M5KG5C7G3EZRSPEV2NSKSVQR","modified_at":"2025-07-02T18:56:39Z","published_at":"2025-07-01T20:13:56Z","references":["https://osv.dev/vulnerability/GHSA-q66q-fx2p-7w4m","https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-q66q-fx2p-7w4m","https://nvd.nist.gov/vuln/detail/CVE-2025-53109","https://github.com/modelcontextprotocol/servers/commit/d00c60df9d74dba8a3bb13113f8904407cda594f","https://github.com/modelcontextprotocol/servers"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-q66q-fx2p-7w4m","url":"https://osv.dev/vulnerability/GHSA-q66q-fx2p-7w4m"},{"source":"nvd","source_id":"CVE-2025-53109","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53109"}],"summary":"@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling"}