Skip to content

DollhouseMCP/mcp-server

v2.0.37 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 22d MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agents ai ai-tools claude codex cursor
+14 more
dollhousemcp ensembles llm mcp mcp-server memory model-context-protocol personas prompt-engineering skills templates typescript vscode windsurf

Affected surfaces

rce_ssrf

Summary

AI summary

Path security hardening rejects symlink-based containment escapes and validation tightening adds input‑length checks.

Full changelog

What's Changed

  • NVM config self-heal (#2338, #2339) — MCP client configs (Claude Desktop, Cursor, Windsurf, LM Studio, Gemini CLI, VS Code, Cline) left pointing at a dead NVM launcher wrapper are repaired automatically on server startup: bare npx is restored when NVM is absent, or the real launcher is regenerated when NVM is present (preserving the #1902 protection). A guardrail prevents temp-directory wrapper paths from ever being written into a client config, and the test suite is fully isolated from real client configs.
  • Path security hardening (#2334) — reject symlink-based containment escapes from allowed directories; preserve element metadata and base-path handling through edit operations. (Remaining missing-base ancestor case tracked in #2342.)
  • Validation tightening (#2334) — content validator input-length checks; explicit ensemble element updates.

Full Changelog: https://github.com/DollhouseMCP/mcp-server/compare/v2.0.36...v2.0.37

Security Fixes

  • Path security hardening prevents symlink‑based containment escape attacks.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track DollhouseMCP/mcp-server

Get notified when new releases ship.

Sign up free

About DollhouseMCP/mcp-server

One-line installable MCP server that adds reusable customization elements — personas, skills, templates, agents, memory, and ensembles (collected customization tools)

All releases →

Related context

Beta — feedback welcome: [email protected]