Roo Code Memory Bank Mcp Server
Monthly
Path traversal in IncomeStreamSurfer roo-code-memory-bank-mcp-server allows local low-privilege users to read or write files outside the intended memory bank directory by supplying crafted file_name arguments to the read_memory_bank_file or append_memory_bank_entry MCP tool endpoints. All code through commit 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e in src/index.ts is affected; the project's rolling release model means no discrete patched version exists and the maintainer had not responded to disclosure at time of analysis. Proof-of-concept code exists per the CVSS 4.0 E:P supplemental metric, though no confirmed active exploitation or CISA KEV listing has been identified.
Path traversal in IncomeStreamSurfer roo-code-memory-bank-mcp-server allows local low-privilege users to read or write files outside the intended memory bank directory by supplying crafted file_name arguments to the read_memory_bank_file or append_memory_bank_entry MCP tool endpoints. All code through commit 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e in src/index.ts is affected; the project's rolling release model means no discrete patched version exists and the maintainer had not responded to disclosure at time of analysis. Proof-of-concept code exists per the CVSS 4.0 E:P supplemental metric, though no confirmed active exploitation or CISA KEV listing has been identified.