https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T08:27:47.438714+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-369345 EUVD-2026-369345 2026-10-05T08:27:47.486334+00:00 EUVD-2026-369345 https://cve.radiocsirt.org/vuln/fkie_cve-2026-57442 fkie_cve-2026-57442 2026-10-05T08:27:47.486380+00:00

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and node_modules path segments do not match the restriction and pass both isAllowed() and isAllowedForListing(). An attacker who influences a path selected by an AI agent can traverse nested repository or Obsidian metadata, read remote URLs or embedded tokens, or cause nested node_modules content to pollute the listAllTags index. This issue is fixed in version 0.11.5.

 https://cve.radiocsirt.org/vuln/ghsa-9c83-rr99-vfwj GHSA-9c83-rr99-vfwj — MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested 2026-10-05T08:27:47.486440+00:00

Affected: npm: @bitbonsai/mcpvault

PathFilter's deny-list glob patterns are anchored, so `.git`, `.obsidian`, and `node_modules` were only blocked at the vault root. Nested copies inside the vault (e.g. `tools/cli/node_modules/...`, `tools/somerepo/.git/config`, a nested `.obsidian/`) were fully traversable via isAllowed/isAllowedForListing. Impact: a nested `.git/config` (remote URLs / embedded tokens) and nested `.obsidian` contents could be read, under the same prompt-injection threat model as GHSA-j99q-93c9-h869 (an attacker influences the path an agent reads). It also caused nested `node_modules` to pollute the tag index (#128, the public symptom). Fixed in 0.11.5 by denying these restricted names at any path depth (matched case-insensitively as any path segment).