Memory Graph
Monthly
Path traversal in aaronsb memory-graph affects three JsonMemoryStorage functions - createDomain, getMemories, and saveMemories - in src/tools/memoryTools.ts, enabling local low-privilege attackers to escape the intended storage directory and read or write arbitrary files accessible to the process. All rolling-release versions through commit 5cfd238 are affected with no vendor patch issued; the project was notified via GitHub issue #14 but has not responded. A proof-of-concept exploit is publicly available (CVSS 4.0 E:P), and no confirmed active exploitation is listed in CISA KEV.
Path traversal in aaronsb memory-graph affects three JsonMemoryStorage functions - createDomain, getMemories, and saveMemories - in src/tools/memoryTools.ts, enabling local low-privilege attackers to escape the intended storage directory and read or write arbitrary files accessible to the process. All rolling-release versions through commit 5cfd238 are affected with no vendor patch issued; the project was notified via GitHub issue #14 but has not responded. A proof-of-concept exploit is publicly available (CVSS 4.0 E:P), and no confirmed active exploitation is listed in CISA KEV.