MCP filesystem directory-size listing follows symlinks and leaks outside-file sizes

The MCP filesystem tool list_directory_with_sizes follows symlinks when listing children, so an inside symlink to an outside file leaks that file's size. Researchers @cybercraftsolutionsllc reproduced it on @modelcontextprotocol/server-filesystem@2026.1.14. Direct reads of that outside file remain blocked; only its size leaks.

Affected

[{"product": "@modelcontextprotocol/server-filesystem (npm)", "affected": ">= 2025.7.1, <= 2026.8.31", "fixed": "Not specified by advisory"}, {"product": "@modelcontextprotocol/server-filesystem (npm)", "affected": ">= 1.0.0, < 2.0.1", "fixed": "2.0.1"}]

Fixed

[{"product": "@modelcontextprotocol/server-filesystem (npm)", "fixed": "2.0.1"}]

An attacker who can place or preserve a symlink inside the allowed directory can cause an MCP client or agent to call the listing tool and learn an outside file's size and existence. The reproduction returned 1.50 KB for a 1,536-byte outside file; file content was not exposed. Preconditions are an outside-target symlink in the allowed tree and attacker influence over the listing call, directly or through prompt injection or repository content.

Two version ranges are affected: date versions from 2025.7.1 through 2026.8.31, for which the advisory specifies no patched version, and semantic versions 1.0.0 up to but not including 2.0.1, fixed in 2.0.1. Because package managers rank 2.0.1 below date versions, users on a date release must install the fix explicitly with npm install @modelcontextprotocol/server-filesystem@2.0.1 or @latest. Researchers advise validating each child path before calling fs.stat, or using fs.lstat and checking any resolved target.