Knowns MCP server let attackers write outside your project

The knowns MCP server let attackers read, create, overwrite, or delete any Markdown file its process could reach. Versions before 0.30.0 didn't validate filesystem paths passed in MCP tool arguments, so a traversal sequence in a tool call walked right out of the project directory.

Anyone running an agent wired to knowns for file access was trusting that agent's tool calls to stay inside the project. Nothing enforced that. NVD published the advisory on September 7 with a CVSS score of 8.8, filed under CWE-22.

The fix is a version bump to 0.30.0. That part's routine. What isn't routine is the count. This is the fourth unvalidated-path-argument bug in an MCP server in the same week, following OGX, OWL, and Rowboat.

Four servers, same root cause, same week. That's not four teams independently making a rare mistake. It's a pattern in how these servers get built: take a path argument from the model, hand it to the filesystem, skip the check that the resolved path still lives inside the project.

If you're running MCP servers with filesystem access, patch knowns to 0.30.0 first, then check whatever else you've wired in. The advisory doesn't say whether other versions or forks of the same server carry the same gap, so don't assume 0.30.0 is the only line that matters here.