Mcpvault
Monthly
MCPVault, a lightweight Model Context Protocol server that exposes Obsidian vault files to AI agents, fails to block access to restricted directories such as .git, .obsidian, and node_modules in versions prior to 0.11.4. PathFilter compiles its deny-list patterns case-sensitively and matches raw path segments, so on case-insensitive macOS and Windows filesystems variants like .Git/config or .GIT/config (and on Windows, trailing-dot/space forms such as .git./config) pass both isAllowed() and isAllowedForListing() while the operating system still opens the real restricted directory. An attacker who can influence a path selected by an AI agent can then read, write, move, search, or list sensitive repository and Obsidian metadata; no public exploit code or CISA KEV entry was identified at time of analysis.
The MCPVault npm package (a lightweight Model Context Protocol server that gives AI agents access to an Obsidian vault) anchored its restricted-directory deny-list to the vault root in versions before 0.11.5, so nested .git, .obsidian and node_modules directories silently pass both isAllowed() and isAllowedForListing(). An attacker who influences which path an AI agent reads — typically through prompt injection in content the agent ingests — can cause nested .git/config files (remote URLs, embedded tokens) or nested Obsidian metadata to be read, and can pollute the listAllTags index with nested node_modules content. No public exploit code or CISA KEV entry was identified at the time of analysis; the vendor shipped the fix in 0.11.5.
MCPVault, a lightweight Model Context Protocol server that exposes Obsidian vault files to AI agents, fails to block access to restricted directories such as .git, .obsidian, and node_modules in versions prior to 0.11.4. PathFilter compiles its deny-list patterns case-sensitively and matches raw path segments, so on case-insensitive macOS and Windows filesystems variants like .Git/config or .GIT/config (and on Windows, trailing-dot/space forms such as .git./config) pass both isAllowed() and isAllowedForListing() while the operating system still opens the real restricted directory. An attacker who can influence a path selected by an AI agent can then read, write, move, search, or list sensitive repository and Obsidian metadata; no public exploit code or CISA KEV entry was identified at time of analysis.
The MCPVault npm package (a lightweight Model Context Protocol server that gives AI agents access to an Obsidian vault) anchored its restricted-directory deny-list to the vault root in versions before 0.11.5, so nested .git, .obsidian and node_modules directories silently pass both isAllowed() and isAllowedForListing(). An attacker who influences which path an AI agent reads — typically through prompt injection in content the agent ingests — can cause nested .git/config files (remote URLs, embedded tokens) or nested Obsidian metadata to be read, and can pollute the listAllTags index with nested node_modules content. No public exploit code or CISA KEV entry was identified at the time of analysis; the vendor shipped the fix in 0.11.5.