GitHub Advisoryadvisory · npm
GHSA-9c83-rr99-vfwj MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested
MEDIUM
Official page ↗
- Aliases
- CVE-2026-57442
- Ecosystem
- npm
- Packages
- @bitbonsai/mcpvault
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Weaknesses
- CWE-22, CWE-538
- Reviewed
- 2026-06-19
Affected packages
• npm @bitbonsai/mcpvault: < 0.11.5 → fixed in 0.11.5
Description
PathFilter's deny-list glob patterns are anchored, so `.git`, `.obsidian`, and `node_modules` were only blocked at the vault root. Nested copies inside the vault (e.g. `tools/cli/node_modules/...`, `tools/somerepo/.git/config`, a nested `.obsidian/`) were fully traversable via isAllowed/isAllowedForListing. Impact: a nested `.git/config` (remote URLs / embedded tokens) and nested `.obsidian` contents could be read, under the same prompt-injection threat model as GHSA-j99q-93c9-h869 (an attacker influences the path an agent reads). It also caused nested `node_modules` to pollute the tag index (#128, the public symptom). Fixed in 0.11.5 by denying these restricted names at any path depth (matched case-insensitively as any path segment).
Related
Alias · CVE (1)
- CVE-2026-57442 MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. vulnerability