GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-F7WF-V2VW-MPCX

Vulnerability from github – Published: 2026-07-17 19:23 – Updated: 2026-07-17 19:23
VLAI
Summary
mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath
Details

Impact

context_import passed the caller-supplied filePath directly to fs.readFileSync with no path confinement. A malicious MCP client — or an LLM agent that is prompt-injected into calling the tool — could point filePath at any file readable by the server process, outside any session or export directory:

  • Full disclosure (JSON files): a valid-JSON target (e.g. another user's exported session, or a *.json credential / service-account file) is parsed and imported into the caller's session, then retrievable verbatim via context_get / context_export.
  • Partial disclosure (any file): for a non-JSON target (e.g. /etc/passwd, an SSH key, a .env), JSON.parse throws and V8 includes a snippet of the file's leading bytes in the SyntaxError message, which was returned verbatim to the caller.

Both ../ traversal and absolute paths worked — there was no path confinement of any kind.

In a typical MCP deployment the server runs on the developer's machine, so the reachable set includes other users' exported memory sessions, JSON credential/config files, and (in leading-bytes form) .env files, SSH keys, and /etc/passwd. The trigger is a tool argument, so the realistic threat model is an LLM agent prompt-injected into calling context_import, or any MCP client connected to the server.

Patches

Fixed in 0.13.0 (PR #36):

  • Imports are confined to a server-owned exports directory (<DATA_DIR>/exports, overridable via MEMORY_KEEPER_EXPORT_DIR), resolved with realpathSync. ../ traversal, absolute paths outside the directory, and symlink escapes are all rejected.
  • File read and JSON.parse are separate operations; read/parse failures return a generic message and never echo file bytes (the SyntaxError-message leak is gone). The database-write path is likewise generic.
  • An E2E security regression suite covers the reported arbitrary-read and traversal vectors, plus symlink escape, the directory-prefix boundary, and a no-existence-oracle check.

Workarounds

Upgrade to >= 0.13.0. There is no configuration-only workaround for affected versions.

Resources

  • Report: GitHub issue #35
  • Fix: PR #36

Credit

Reported by Zhihao Zhang (@mcfly-zzh).

Severity
6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mcp-memory-keeper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54561"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-17T19:23:07Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\n`context_import` passed the caller-supplied `filePath` directly to `fs.readFileSync` with no path confinement. A malicious MCP client \u2014 or an LLM agent that is prompt-injected into calling the tool \u2014 could point `filePath` at **any file readable by the server process**, outside any session or export directory:\n\n- **Full disclosure (JSON files):** a valid-JSON target (e.g. another user\u0027s exported session, or a `*.json` credential / service-account file) is parsed and imported into the caller\u0027s session, then retrievable verbatim via `context_get` / `context_export`.\n- **Partial disclosure (any file):** for a non-JSON target (e.g. `/etc/passwd`, an SSH key, a `.env`), `JSON.parse` throws and V8 includes a snippet of the file\u0027s leading bytes in the `SyntaxError` message, which was returned verbatim to the caller.\n\nBoth `../` traversal and absolute paths worked \u2014 there was no path confinement of any kind.\n\nIn a typical MCP deployment the server runs on the developer\u0027s machine, so the reachable set includes other users\u0027 exported memory sessions, JSON credential/config files, and (in leading-bytes form) `.env` files, SSH keys, and `/etc/passwd`. The trigger is a tool argument, so the realistic threat model is an LLM agent prompt-injected into calling `context_import`, or any MCP client connected to the server.\n\n### Patches\n\nFixed in **0.13.0** (PR #36):\n\n- Imports are confined to a server-owned exports directory (`\u003cDATA_DIR\u003e/exports`, overridable via `MEMORY_KEEPER_EXPORT_DIR`), resolved with `realpathSync`. `../` traversal, absolute paths outside the directory, and symlink escapes are all rejected.\n- File read and `JSON.parse` are separate operations; read/parse failures return a generic message and never echo file bytes (the `SyntaxError`-message leak is gone). The database-write path is likewise generic.\n- An E2E security regression suite covers the reported arbitrary-read and traversal vectors, plus symlink escape, the directory-prefix boundary, and a no-existence-oracle check.\n\n### Workarounds\n\nUpgrade to **`\u003e= 0.13.0`**. There is no configuration-only workaround for affected versions.\n\n### Resources\n\n- Report: GitHub issue #35\n- Fix: PR #36\n\n### Credit\n\nReported by Zhihao Zhang ([@mcfly-zzh](https://github.com/mcfly-zzh)).",
  "id": "GHSA-f7wf-v2vw-mpcx",
  "modified": "2026-07-17T19:23:07Z",
  "published": "2026-07-17T19:23:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mkreyman/mcp-memory-keeper/security/advisories/GHSA-f7wf-v2vw-mpcx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mkreyman/mcp-memory-keeper/issues/35"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mkreyman/mcp-memory-keeper/pull/36"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mkreyman/mcp-memory-keeper/commit/84f6dfa692736a34ff36e2d2cf2188b71facf73b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mkreyman/mcp-memory-keeper"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mkreyman/mcp-memory-keeper/releases/tag/v0.13.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.