EUVD-2026-54852
GHSA-46jg-c454-8hm3
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privileges required per description and CVSS 4.0 source; no availability impact as traversal enables read/write but not service disruption.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. This affects the function readMemoryBankFile/appendMemoryBankEntry of the file src/index.ts of the component read_memory_bank_file/append_memory_bank_entry. Such manipulation of the argument file_name leads to path traversal. The attack must be carried out locally. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in IncomeStreamSurfer roo-code-memory-bank-mcp-server allows local low-privilege users to read or write files outside the intended memory bank directory by supplying crafted file_name arguments to the read_memory_bank_file or append_memory_bank_entry MCP tool endpoints. All code through commit 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e in src/index.ts is affected; the project's rolling release model means no discrete patched version exists and the maintainer had not responded to disclosure at time of analysis. Proof-of-concept code exists per the CVSS 4.0 E:P supplemental metric, though no confirmed active exploitation or CISA KEV listing has been identified.
Technical ContextAI
The roo-code-memory-bank-mcp-server is a Model Context Protocol (MCP) server implementation that exposes memory bank file operations as tool endpoints for AI coding assistants such as Roo Code. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the functions readMemoryBankFile and appendMemoryBankEntry in src/index.ts accept a caller-supplied file_name parameter and construct filesystem paths without canonicalization, sanitization, or boundary enforcement. An attacker can inject traversal sequences such as '../../' to escape the designated memory bank directory. The CPE cpe:2.3:a:incomestreamsurfer:roo-code-memory-bank-mcp-server:*:*:*:*:*:*:*:* covers all releases, consistent with the rolling release model where no versioned artifacts are published.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer had not responded to the responsible disclosure issue filed at https://github.com/IncomeStreamSurfer/roo-code-memory-bank-mcp-server/issues/7. Users should monitor the repository for commits to src/index.ts that introduce path canonicalization (e.g., path.resolve with boundary checks) or allowlist validation of the file_name parameter. As an immediate compensating control, restrict the OS user account running the MCP server to the narrowest possible filesystem permissions - specifically, read/write only within the memory bank directory - so that traversal attempts cannot reach files beyond that scope; the trade-off is a minor operational setup cost. Running the server inside a container or chroot jail with a restricted filesystem view provides defense-in-depth, at the cost of deployment complexity. If the memory bank directory or sibling paths contain sensitive data, relocating those files to paths inaccessible to the server's process user is an effective interim measure with no functional side effects.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today