Skip to content
OpenAdvisories

Package · npm

@bitbonsai/mcpvault

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.9
    CVE-2026-57442

    MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested

    MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and node_modules path segments do not mat…

    bitbonsai mcpvault @bitbonsai/mcpvault npm
  • High 8.4
    CVE-2026-57441

    MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

    MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesyste…

    bitbonsai mcpvault @bitbonsai/mcpvault npm