MCP Filesystem validated one path spelling and used another

A path check is meaningful only for the exact object later opened. In the disclosed test, the normalized candidate matched an allowed directory while the operating system followed a different, quote-suffixed sibling. An agent receiving hostile file or page content could be induced to supply such a path through its filesystem tool. primary evidence documents a controlled read and the possibility of write or move when the sibling directory exists.

The experiment is a local check/use demonstration. It does not establish deployment prevalence or that a remote attacker without influence over an agent or tool arguments already had filesystem access.

Version 2.0.1 addressed the reported class; the advisory notes that date-based npm versions may not automatically upgrade to semver 2.0.1. Canonical path identity must be shared by validation and operations.

This is a check/use mismatch without a race. validatePath authorizes normalizePath(absolute), which strips a trailing quote or whitespace; fs.realpath and the subsequent call use the original absolute spelling. An attacker-controlled argument can thus be approved as /allowed/proj while resolving to a separate sibling such as /allowed/proj'. The relevant precondition is control over the tool argument and existence of the sibling, not an existing remote shell. Official release 2.0.1 lists the fix; migration from date-stamped package versions to semver may require an explicit upgrade.