io.github.bytedance/mcp-server-filesystem
MCP server for filesystem access
Update first. Issues have been reported, but none is flagged on the version the registry lists. That version can trail the package's newest release, so check you run one past the issues below.
Registry name io.github.bytedance/mcp-server-filesystem
· The registry calls this server version 1.0.0, but the package it points to is latest. The package version is what gets installed, so that's the one we check. · Source code
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| CVE-2026-81735startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authenti… | critical | Not checked | Aug 27, 2026 |
Versions in the registry
1.0.0 (package latest) (listed)