{"id":"ghsa-ghsa-7w82-6f9j-v9jp","seq":2056992,"kind":"advisory","title":"mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths","url":"https://github.com/advisories/GHSA-7w82-6f9j-v9jp","permalink":"https://vulnpulse.app/items/ghsa-ghsa-7w82-6f9j-v9jp","summary":"影響: npm:mcp-sanitizer < 1.4.0 → 1.4.0\nFile Path Sanitizer Permits Arbitrary User-Home Absolute Paths Summary mcp-sanitizer v1.3.3 explicitly whitelists /home/ and /Users/ as allowed absolute path prefixes in its file path validation logic (src/utils/validation-utils.js:188-196). As a result, paths such as /home/alice/.ssh/id_rsa and /home/alice/.aws/credentials pass through sanitizer.sanitize() with blocked=false, even though they point to highly sensitive files outside any configured safe root. Any consumer application that trusts…","severity":"high","techs":["nodejs"],"cves":[],"tags":["GHSA-7w82-6f9j-v9jp","mcp-sanitizer"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T19:51:34.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}