8nite metatrader-4-mcp EUVD-2026-26777

No vendor-released patch has been identified at time of analysis; the project maintainers have not responded to early disclosure. Immediate mitigation requires input validation and sanitization of the ea_name parameter: implement strict allowlist validation to accept only expected expert advisor filenames without path traversal sequences, reject any input containing ../ or absolute paths, and use Node.js path.resolve() and path.relative() to canonicalize paths and verify they remain within the intended directory before file system operations. As a compensating control, run the metatrader-4-mcp service with minimal file system permissions - restrict the process to read-only access to only the specific directories containing legitimate expert advisor files, preventing directory traversal from granting access to sensitive system files even if the code is exploited. For deployment contexts where multiple users share the same metatrader-4-mcp instance, enforce strong authentication and limit credential distribution only to trusted operators. Monitor file system access logs for suspicious path patterns containing ../ or unexpected file reads from users of the service. Consider disabling the sync_ea_from_file component entirely if not actively used, reducing the attack surface until a patched version is released.