EUVD-2026-78828
GHSA-f7wf-v2vw-mpcx
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:L reflects MCP server's local deployment model; PR:N because any connected MCP client triggers the read without authentication; C:H from full JSON credential disclosure; I:N and A:N as no write or availability impact.
Primary rating from Vendor (https://github.com/mkreyman/mcp-memory-keeper).
CVSS VectorVendor: https://github.com/mkreyman/mcp-memory-keeper
Lifecycle Timeline
2DescriptionCVE.org
Impact
context_import passed the caller-supplied filePath directly to fs.readFileSync with no path confinement. A malicious MCP client - or an LLM agent that is prompt-injected into calling the tool - could point filePath at any file readable by the server process, outside any session or export directory:
- Full disclosure (JSON files): a valid-JSON target (e.g. another user's exported session, or a
*.jsoncredential / service-account file) is parsed and imported into the caller's session, then retrievable verbatim viacontext_get/context_export. - Partial disclosure (any file): for a non-JSON target (e.g.
/etc/passwd, an SSH key, a.env),JSON.parsethrows and V8 includes a snippet of the file's leading bytes in theSyntaxErrormessage, which was returned verbatim to the caller.
Both ../ traversal and absolute paths worked - there was no path confinement of any kind.
In a typical MCP deployment the server runs on the developer's machine, so the reachable set includes other users' exported memory sessions, JSON credential/config files, and (in leading-bytes form) .env files, SSH keys, and /etc/passwd. The trigger is a tool argument, so the realistic threat model is an LLM agent prompt-injected into calling context_import, or any MCP client connected to the server.
Patches
Fixed in 0.13.0 (PR #36):
- Imports are confined to a server-owned exports directory (
<DATA_DIR>/exports, overridable viaMEMORY_KEEPER_EXPORT_DIR), resolved withrealpathSync.../traversal, absolute paths outside the directory, and symlink escapes are all rejected. - File read and
JSON.parseare separate operations; read/parse failures return a generic message and never echo file bytes (theSyntaxError-message leak is gone). The database-write path is likewise generic. - An E2E security regression suite covers the reported arbitrary-read and traversal vectors, plus symlink escape, the directory-prefix boundary, and a no-existence-oracle check.
Workarounds
Upgrade to >= 0.13.0. There is no configuration-only workaround for affected versions.
Resources
- Report: GitHub issue #35
- Fix: PR #36
Credit
Reported by Zhihao Zhang (@mcfly-zzh).
AnalysisAI
Arbitrary local file read in mcp-memory-keeper versions prior to 0.13.0 allows any connected MCP client or prompt-injected LLM agent to exfiltrate files readable by the server process by supplying a crafted filePath to the context_import tool. JSON files (credential files, service-account keys, other users' exported sessions) are parsed and imported into the attacker's session, then retrievable verbatim via context_get or context_export; non-JSON files (SSH keys, .env files, /etc/passwd) leak their leading bytes through a V8 SyntaxError message echoed back to the caller. No public exploit identified at time of analysis, but E2E regression tests in the fix PR confirm all three attack vectors - arbitrary JSON read, byte-leak, and ../ traversal - are reliably reproducible in affected versions.
Technical ContextAI
mcp-memory-keeper (pkg:npm/mcp-memory-keeper) is a Node.js Model Context Protocol server that provides persistent memory and context management for LLM agents. The context_import tool accepted a caller-supplied filePath argument and passed it without any normalization or confinement directly to Node.js fs.readFileSync, the textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) pattern. Both ../ relative traversal and absolute paths were accepted with no restriction. A secondary information-disclosure vector exploited a V8 JavaScript engine behavior: when JSON.parse receives non-JSON input it throws a SyntaxError whose message includes a snippet of the input data, and this exception message was returned verbatim to the MCP caller, leaking leading bytes of arbitrary files that cannot be JSON-parsed. The fix in 0.13.0 uses realpathSync to resolve symlinks before a directory-prefix check, separates the read and parse operations so neither error path echoes file content, and enforces a configurable exports directory (MEMORY_KEEPER_EXPORT_DIR) as the only permitted import source.
RemediationAI
Upgrade mcp-memory-keeper to version 0.13.0 or later (npm install mcp-memory-keeper@>=0.13.0). The vendor-released patch 0.13.0 (PR #36, commit 84f6dfa692736a34ff36e2d2cf2188b71facf73b) is the only supported fix; the advisory explicitly states there is no configuration-only workaround for affected versions. After upgrading, if MEMORY_KEEPER_EXPORT_DIR is configured, point it at a dedicated empty directory rather than a home folder or any tree containing secrets, because any JSON file placed in that directory becomes importable by any MCP client. Existing exports written to the OS temp directory by versions prior to 0.13.0 must be manually moved into the new exports directory to be re-importable. If immediate upgrade is not feasible, restrict which processes and users can connect to the MCP server at the OS or network layer, and audit the server process user's readable file set for sensitive JSON credential files - these represent the highest-impact exfiltration targets. See https://github.com/mkreyman/mcp-memory-keeper/security/advisories/GHSA-f7wf-v2vw-mpcx for full advisory details.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today