{"id":"CVE-2026-54561","aliases":["EUVD-2026-78828","GHSA-f7wf-v2vw-mpcx"],"status":"published","title":"MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath","description":"MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller-controlled filePath directly to fs.readFileSync without restricting the path to an export directory. An MCP client, including an LLM agent induced to call the tool, can use ../ traversal or an absolute path to target any file readable by the server process. A valid JSON file is parsed and imported into the caller's session, allowing its full contents to be retrieved through context_get or context_export, while JSON.parse errors for non-JSON files can return leading file bytes in a SyntaxError message. The two disclosure modes can expose other exported sessions, JSON credentials or service-account files, environment files, and portions of SSH keys or other local files. This issue is fixed in version 0.13.0.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00249,"percentile":0.16404,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-209","CWE-22"],"published":"2026-07-17T19:23:07Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"npm","package":"mcp-memory-keeper","fixed_in":["0.13.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mcp-memory-keeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0"}]}]},{"source":"osv","ecosystem":"npm","package":"mcp-memory-keeper","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.13.0"}]}]}],"products":[{"vendor":"mkreyman","product":"mcp-memory-keeper"}],"references":[{"url":"https://github.com/mkreyman/mcp-memory-keeper/security/advisories/GHSA-f7wf-v2vw-mpcx","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/mkreyman/mcp-memory-keeper/issues/35","tags":["x_refsource_MISC","exploit","report","web"]},{"url":"https://github.com/mkreyman/mcp-memory-keeper/pull/36","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mkreyman/mcp-memory-keeper/commit/58640c22e037572e0b03bc0aa25d015ea98dcc6d","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/mkreyman/mcp-memory-keeper/commit/b9369568468007c85f8aec3ae09ca6f611285bc5","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/mkreyman/mcp-memory-keeper/commit/e0ab521a9e8343bcab1ca60ccc3601e4d86eaa97","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/mkreyman/mcp-memory-keeper/releases/tag/v0.13.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/mkreyman/mcp-memory-keeper/commit/84f6dfa692736a34ff36e2d2cf2188b71facf73b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f7wf-v2vw-mpcx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54561.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54561","tags":["advisory"]},{"url":"https://github.com/mkreyman/mcp-memory-keeper","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54561","title":"MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath","description":"MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller-controlled filePath directly to fs.readFileSync without restricting the path to an export directory. An MCP client, including an LLM agent induced to call the tool, can use ../ traversal or an absolute path to target any file readable by the server process. A valid JSON file is parsed and imported into the caller's session, allowing its full contents to be retrieved through context_get or context_export, while JSON.parse errors for non-JSON files can return leading file bytes in a SyntaxError message. The two disclosure modes can expose other exported sessions, JSON credentials or service-account files, environment files, and portions of SSH keys or other local files. This issue is fixed in version 0.13.0.","status":"published","published":"2026-09-15T16:32:01.307Z","modified":"2026-09-15T17:28:58.028Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22","CWE-209"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-78828","description":"MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller-controlled filePath directly to fs.readFileSync without restricting the path to an export directory. An MCP client, including an LLM agent induced to call the tool, can use ../ traversal or an absolute path to target any file readable by the server process. A valid JSON file is parsed and imported into the caller's session, allowing its full contents to be retrieved through context_get or context_export, while JSON.parse errors for non-JSON files can return leading file bytes in a SyntaxError message. The two disclosure modes can expose other exported sessions, JSON credentials or service-account files, environment files, and portions of SSH keys or other local files. This issue is fixed in version 0.13.0.","status":"published","published":"2026-09-15T16:32:01Z","modified":"2026-09-15T17:28:58Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:17.768191Z"}],"ghsa":[{"id":"GHSA-f7wf-v2vw-mpcx","title":"mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath","description":"### Impact\n\n`context_import` passed the caller-supplied `filePath` directly to `fs.readFileSync` with no path confinement. A malicious MCP client — or an LLM agent that is prompt-injected into calling the tool — could point `filePath` at **any file readable by the server process**, outside any session or export directory:\n\n- **Full disclosure (JSON files):** a valid-JSON target (e.g. another user's exported session, or a `*.json` credential / service-account file) is parsed and imported into the caller's session, then retrievable verbatim via `context_get` / `context_export`.\n- **Partial disclosure (any file):** for a non-JSON target (e.g. `/etc/passwd`, an SSH key, a `.env`), `JSON.parse` throws and V8 includes a snippet of the file's leading bytes in the `SyntaxError` message, which was returned verbatim to the caller.\n\nBoth `../` traversal and absolute paths worked — there was no path confinement of any kind.\n\nIn a typical MCP deployment the server runs on the developer's machine, so the reachable set includes other users' exported memory sessions, JSON credential/config files, and (in leading-bytes form) `.env` files, SSH keys, and `/etc/passwd`. The trigger is a tool argument, so the realistic threat model is an LLM agent prompt-injected into calling `context_import`, or any MCP client connected to the server.\n\n### Patches\n\nFixed in **0.13.0** (PR #36):\n\n- Imports are confined to a server-owned exports directory (`\u003cDATA_DIR\u003e/exports`, overridable via `MEMORY_KEEPER_EXPORT_DIR`), resolved with `realpathSync`. `../` traversal, absolute paths outside the directory, and symlink escapes are all rejected.\n- File read and `JSON.parse` are separate operations; read/parse failures return a generic message and never echo file bytes (the `SyntaxError`-message leak is gone). The database-write path is likewise generic.\n- An E2E security regression suite covers the reported arbitrary-read and traversal vectors, plus symlink escape, the directory-prefix boundary, and a no-existence-oracle check.\n\n### Workarounds\n\nUpgrade to **`\u003e= 0.13.0`**. There is no configuration-only workaround for affected versions.\n\n### Resources\n\n- Report: GitHub issue #35\n- Fix: PR #36\n\n### Credit\n\nReported by Zhihao Zhang ([@mcfly-zzh](https://github.com/mcfly-zzh)).","status":"published","published":"2026-07-17T19:23:07Z","modified":"2026-07-17T19:23:08Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22","CWE-209"],"updated_at":"2026-11-02T14:40:46.257074Z"}],"nvd":[{"id":"CVE-2026-54561","description":"MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller-controlled filePath directly to fs.readFileSync without restricting the path to an export directory. An MCP client, including an LLM agent induced to call the tool, can use ../ traversal or an absolute path to target any file readable by the server process. A valid JSON file is parsed and imported into the caller's session, allowing its full contents to be retrieved through context_get or context_export, while JSON.parse errors for non-JSON files can return leading file bytes in a SyntaxError message. The two disclosure modes can expose other exported sessions, JSON credentials or service-account files, environment files, and portions of SSH keys or other local files. This issue is fixed in version 0.13.0.","status":"published","published":"2026-09-15T17:17:21.22Z","modified":"2026-09-30T17:51:56.193Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22","CWE-209"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"CVE-2026-54561","title":"MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath","description":"MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller-controlled filePath directly to fs.readFileSync without restricting the path to an export directory. An MCP client, including an LLM agent induced to call the tool, can use ../ traversal or an absolute path to target any file readable by the server process. A valid JSON file is parsed and imported into the caller's session, allowing its full contents to be retrieved through context_get or context_export, while JSON.parse errors for non-JSON files can return leading file bytes in a SyntaxError message. The two disclosure modes can expose other exported sessions, JSON credentials or service-account files, environment files, and portions of SSH keys or other local files. This issue is fixed in version 0.13.0.","status":"published","published":"2026-09-15T16:32:01.307Z","modified":"2026-10-28T02:30:31.194088548Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-209","CWE-22"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-f7wf-v2vw-mpcx","title":"mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath","description":"### Impact\n\n`context_import` passed the caller-supplied `filePath` directly to `fs.readFileSync` with no path confinement. A malicious MCP client — or an LLM agent that is prompt-injected into calling the tool — could point `filePath` at **any file readable by the server process**, outside any session or export directory:\n\n- **Full disclosure (JSON files):** a valid-JSON target (e.g. another user's exported session, or a `*.json` credential / service-account file) is parsed and imported into the caller's session, then retrievable verbatim via `context_get` / `context_export`.\n- **Partial disclosure (any file):** for a non-JSON target (e.g. `/etc/passwd`, an SSH key, a `.env`), `JSON.parse` throws and V8 includes a snippet of the file's leading bytes in the `SyntaxError` message, which was returned verbatim to the caller.\n\nBoth `../` traversal and absolute paths worked — there was no path confinement of any kind.\n\nIn a typical MCP deployment the server runs on the developer's machine, so the reachable set includes other users' exported memory sessions, JSON credential/config files, and (in leading-bytes form) `.env` files, SSH keys, and `/etc/passwd`. The trigger is a tool argument, so the realistic threat model is an LLM agent prompt-injected into calling `context_import`, or any MCP client connected to the server.\n\n### Patches\n\nFixed in **0.13.0** (PR #36):\n\n- Imports are confined to a server-owned exports directory (`\u003cDATA_DIR\u003e/exports`, overridable via `MEMORY_KEEPER_EXPORT_DIR`), resolved with `realpathSync`. `../` traversal, absolute paths outside the directory, and symlink escapes are all rejected.\n- File read and `JSON.parse` are separate operations; read/parse failures return a generic message and never echo file bytes (the `SyntaxError`-message leak is gone). The database-write path is likewise generic.\n- An E2E security regression suite covers the reported arbitrary-read and traversal vectors, plus symlink escape, the directory-prefix boundary, and a no-existence-oracle check.\n\n### Workarounds\n\nUpgrade to **`\u003e= 0.13.0`**. There is no configuration-only workaround for affected versions.\n\n### Resources\n\n- Report: GitHub issue #35\n- Fix: PR #36\n\n### Credit\n\nReported by Zhihao Zhang ([@mcfly-zzh](https://github.com/mcfly-zzh)).","status":"published","published":"2026-07-17T19:23:07Z","modified":"2026-07-31T05:15:33.861007462Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-209","CWE-22"],"updated_at":"2026-11-02T15:46:46.006631Z"}]}}