Gemsuite Mcp
Monthly
Path traversal in PV-Bhat gemsuite-mcp 1.0.0 exposes arbitrary local files to any authenticated local user who can invoke the tool's Gemini handler functions. The flaw resides in src/handlers/unified-gemini.ts and affects the gemini_search, gemini_reason, gemini_process, and gemini_analyze handlers, all of which accept file_path or file_paths arguments without sufficient sanitization. No patch has been released and the project has not responded to the responsible disclosure; no public exploit or active exploitation has been identified at time of analysis.
Path traversal in PV-Bhat gemsuite-mcp 1.0.0 exposes arbitrary local files to any authenticated local user who can invoke the tool's Gemini handler functions. The flaw resides in src/handlers/unified-gemini.ts and affects the gemini_search, gemini_reason, gemini_process, and gemini_analyze handlers, all of which accept file_path or file_paths arguments without sufficient sanitization. No patch has been released and the project has not responded to the responsible disclosure; no public exploit or active exploitation has been identified at time of analysis.