EUVD-2026-41610
GHSA-fwpr-59hh-gr98
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with low complexity; low privileges required per CVSS 4.0 source vector; confidentiality-only low impact consistent with CWE-668 resource exposure and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of the file src/managers/MemoryManager.ts of the component Per-Project Auto-Memory Handler. Such manipulation of the argument workspacePath leads to exposure of resource. The attack may be performed from remote. Upgrading to version 0.4.0 is sufficient to fix this issue. The name of the patch is 6d709229b5199f6769fb3cf763e5122dcc43c079. It is advisable to upgrade the affected component.
AnalysisAI
Information disclosure in DeepMyst Mysti's Per-Project Auto-Memory Handler allows low-privileged remote attackers to expose resources by supplying a manipulated workspacePath argument to the initProjectMemory function in src/managers/MemoryManager.ts. EUVD-2026-41610 confirms versions 0.1 through 0.4.0 are affected. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects a limited, confidentiality-only impact with no integrity or availability consequences.
Technical ContextAI
DeepMyst Mysti (CPE: cpe:2.3:a:deepmyst:mysti) is a software tool that includes a Per-Project Auto-Memory Handler component responsible for initializing project-scoped memory. The vulnerable entry point is the initProjectMemory function in src/managers/MemoryManager.ts, which accepts a caller-supplied workspacePath argument. CWE-668 (Exposure of Resource to Wrong Sphere) identifies the root cause: the function fails to properly validate or constrain the workspacePath input, allowing it to reference resources outside the intended project memory boundary. This is consistent with a path traversal or insufficient input sanitization pattern where an attacker-controlled path value directs the application to expose file system resources, project metadata, or internal data beyond the authorized scope of the calling user.
RemediationAI
The upstream fix is delivered via GitHub PR #49 (https://github.com/DeepMyst/Mysti/pull/49) and commit 6d709229b5199f6769fb3cf763e5122dcc43c079. The CVE description asserts that upgrading to version 0.4.0 is sufficient; however, because EUVD simultaneously lists 0.4.0 as an affected version, administrators should verify their installed build incorporates commit 6d709229b5199f6769fb3cf763e5122dcc43c079 before treating any 0.4.0 instance as patched. If immediate upgrade is not feasible, restrict network-level access to the Mysti service to only authorized low-privileged users, and audit which accounts have permission to invoke the Per-Project Auto-Memory Handler - reducing this set limits the exploitable attacker pool. The trade-off of strict access restriction may impact legitimate collaborative project workflows.
Same weakness CWE-668 – Exposure of Resource to Wrong Sphere
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today