With Context Mcp
Monthly
Path traversal in boxpositron/with-context-mcp up to version 3.0.7 exposes the host filesystem through four note-management functions - ingest_notes, teleport_notes, sync_notes, and project_folder - in src/index.ts, allowing unauthenticated remote attackers to read or write files outside the intended working directory. The affected package is a Model Context Protocol (MCP) server, meaning exploitation is triggered via tool-call requests sent to the MCP endpoint, a vector inherently accessible to any AI agent or client connected to the server. A publicly available proof-of-concept has been disclosed via a GitHub issue; the vendor had not responded to the coordinated disclosure at time of reporting, leaving affected versions unpatched.
Path traversal in boxpositron/with-context-mcp up to version 3.0.7 exposes the host filesystem through four note-management functions - ingest_notes, teleport_notes, sync_notes, and project_folder - in src/index.ts, allowing unauthenticated remote attackers to read or write files outside the intended working directory. The affected package is a Model Context Protocol (MCP) server, meaning exploitation is triggered via tool-call requests sent to the MCP endpoint, a vector inherently accessible to any AI agent or client connected to the server. A publicly available proof-of-concept has been disclosed via a GitHub issue; the vendor had not responded to the coordinated disclosure at time of reporting, leaving affected versions unpatched.