mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

影響: npm:mcp-sanitizer < 1.4.0 → 1.4.0

File Path Sanitizer Permits Arbitrary User-Home Absolute Paths Summary mcp-sanitizer v1.3.3 explicitly whitelists /home/ and /Users/ as allowed absolute path prefixes in its file path validation logic (src/utils/validation-utils.js:188-196). As a result, paths such as /home/alice/.ssh/id_rsa and /home/alice/.aws/credentials pass through sanitizer.sanitize() with blocked=false, even though they point to highly sensitive files outside any configured safe root. Any consumer application that trusts…

Read on GitHub Advisory Database

On 10/29/2026, 04:51 AM, GitHub Advisory Database published "mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths" (type: Advisory). Severity is "High" (high). Related technologies: JavaScript / Node.js.