telexed ~ c / 70c160bd-938radar:50 · agent_toolLIVE
← back
NO.
#70c160bd
Topic
AGENTS & TOOLS
Source
MCP Servers
Published
2026-05-05 13:55:44
Importance
★ 5/10 — radar 50
`MCP Servers` Python workspaces patch multiple security alerts
FIG-0701:1

`MCP Servers` Python workspaces patch multiple security alerts

Security fixes landed across git, fetch, and time workspaces. Worth updating if you run official MCP servers; no product-level feature change.

[ KEY POINTS ]
  1. gitpython moved from 3.1.45 to 3.1.49, closing high-severity command injection paths through Git options validation.
  2. lxml 5.3.0 to 6.1.0 fixes XXE exposure in parser defaults; fetch servers handling untrusted XML should update quickly.
  3. pyjwt 2.10.1 to 2.12.1 closes unknown crit header acceptance across all three Python workspaces.
  4. Verification is solid: uv run pytest passed with 20 fetch, 38 time, and 41 git tests; Windows cleanup errors were preexisting.
Originalgithub.com/modelcontextprotocol/servers/commit/0db9a34071c9b4d7568e4d1508139e3405434e1cRead original →

// related