How to fix CVE-2024-21907 Newtonsoft.Json 10.0.2 alert in Azure MCP Docker image 0.8.3?
How do I fix the high CVE-2024-21907 vulnerability alert for Newtonsoft.Json 10.0.2 in the Azure MCP Server Docker image 0.8.3?
Originally asked on GitHub: https://github.com/microsoft/mcp/issues/657
3 answers
Fixed: the vulnerable Newtonsoft.Json dependency was pinned and shipped in release 0.8.5 (released 2025-10-13), so the recommended fix is to upgrade the Docker image tag from 0.8.3 to 0.8.5.
The issue was caused by the Cosmos DB library pulling in Newtonsoft.Json 10.0.2, which is flagged for CVE-2024-21907. Maintainers addressed it in PR #662 by adding a direct dependency pinned to the fixed version in
Directory.Packages.props, forcing the newer package version into the build until the Cosmos team updated their own dependency. The fix is included in 0.8.5.For your own builds, pinning the transitive dependency in
Directory.Packages.propsis the same approach the maintainers used, and they plan to remove the pin once the upstream Cosmos package ships the fixed Newtonsoft.Json version.Did this work for you?What a GitHub user tried on GitHub (Worked)
The reporter ran
trivy image azure-sdk/azure-mcp:0.8.3on the published Docker image and confirmed that it reported Newtonsoft.Json 10.0.2 as vulnerable to CVE-2024-21907.Source: https://github.com/microsoft/mcp/issues/657 (opens external site)
Did this work for you?What @anuchandy tried on GitHub (Worked)
A maintainer added a direct dependency pinned to the fixed Newtonsoft.Json version in
Directory.Packages.propsvia PR #662, which forced the newer version into the build and was released in 0.8.5.Source: https://github.com/microsoft/mcp/issues/657#issuecomment-3377982873 (opens external site)
Did this work for you?