knowns MCP Server EUVD-2026-72559

Exploitation requires that the attacker can send an MCP tool call (specifically an action targeting code replacement, insertion, deletion, or rename) to the knowns MCP server process. The server must be reachable over the network or locally; the CVSS 4.0 AV:N rating indicates network exposure is the assessed baseline. Passive user interaction (UI:P) is required - a developer must have initiated a knowns MCP session, meaning the server process is running. No authentication credential is required (PR:N). The attacker must supply a path parameter containing either an absolute filesystem path (e.g., /etc/cron.d/backdoor) or a relative path with directory traversal sequences (e.g., ../../.ssh/authorized_keys). What limits exploitation: the MCP server must be network-accessible rather than strictly localhost-only; on default single-developer workstation deployments, the server may only listen on loopback, requiring local process access or prompt injection via an AI client to deliver the payload. Versions 0.30.0 and later are not vulnerable due to the safepath containment guard.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) scores 7.2 and captures the key risk profile accurately: network-reachable, low complexity, no authentication, with passive user interaction reflecting that a developer must be running the MCP server session. Real-world risk is meaningful but bounded: this is a developer-facing tool, so the attack surface is developers' workstations rather than production infrastructure - however, writing to ~/.ssh/authorized_keys or shell rc files yields persistent unauthorized access to the developer's machine and, by extension, any systems they can reach. EPSS data is not available in the provided input, limiting probability-of-exploitation comparison. No KEV listing; no public exploit confirmed. The CVSS integrity and availability impacts (VI:H/VA:H) are accurate - arbitrary file writes to critical dotfiles can both corrupt the system (A:H) and implant backdoors (I:H). The C:L rating is plausible because the vulnerability is primarily write-oriented, but a write to a symlinked or log file could result in indirect read amplification. Overall: elevated priority for teams using knowns in multi-user or CI environments; lower urgency for fully isolated single-developer setups.

An attacker who can send requests to a developer's locally running knowns MCP server - whether through a malicious AI prompt injection, a compromised AI client, or direct API access on a shared host - sends a code_replace MCP call with path set to ../../home/user/.ssh/authorized_keys and content containing their own public key. The pre-0.30.0 server resolves the path outside the project root without validation and writes the attacker's key, granting persistent SSH access to the developer's machine. No public exploit is confirmed, but the GitHub advisory and VulnCheck report supply sufficient implementation detail to reproduce the technique trivially.