https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:43:47.204877+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-368957 EUVD-2026-368957 2026-10-02T10:43:47.207102+00:00 EUVD-2026-368957 https://cve.radiocsirt.org/vuln/fkie_cve-2026-57441 fkie_cve-2026-57441 2026-10-02T10:43:47.207131+00:00

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On case-insensitive macOS and Windows filesystems, case variants of .git, .obsidian, or node_modules pass both isAllowed() and isAllowedForListing() even though the operating system opens the restricted directory, and Windows trailing dots or spaces provide the same bypass. An attacker who influences a path selected by an AI agent can use the bypass in read, write, move, search, or listing operations to expose or modify sensitive repository and Obsidian metadata. Vault-root .. containment is not affected. This issue is fixed in version 0.11.4.

 https://cve.radiocsirt.org/vuln/ghsa-j99q-93c9-h869 GHSA-j99q-93c9-h869 — MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence 2026-10-02T10:43:47.207163+00:00

Affected: npm: @bitbonsai/mcpvault

On case-insensitive filesystems (macOS, Windows), PathFilter compiled its deny-list patterns case-sensitively and matched the path verbatim, so names like `.Git/config`, `.GIT/config`, or `.oBsIdIaN/secrets.md` slipped past the `.git`/`.obsidian`/`node_modules` restriction while the OS opened the real file. On Windows, trailing dots/spaces (`.git./config`, `.git /config`) bypassed it the same way. Affects both `isAllowed` (read/write/move/search) and `isAllowedForListing`. Vault-root `..` containment is NOT affected. Fixed in 0.11.4 by case-insensitive matching plus per-segment canonicalization before the deny-list check. Reported privately by novice-22.