GitHub Advisoryadvisory · PyPI

GHSA-vc5j-42hh-j3mr notes-mcp has a Path Traversal issue

MEDIUM Published 2026-04-28 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-7212
Ecosystem
PyPI
Packages
notes-mcp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-22
Reviewed
2026-05-06

Affected packages

• PyPI notes-mcp: <= 0.1.4 (no fix yet)

Description

A security vulnerability has been detected in edvardlindelof notes-mcp up to 0.1.4. This affects an unknown function of the file notes_mcp.py. The manipulation of the argument root_dir/path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Related

Alias · CVE (1)

  • CVE-2026-7212 A security vulnerability has been detected in edvardlindelof notes-mcp up to 0.1.4. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References