## mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- 公開日時: 2026-10-28T19:51:34.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-7w82-6f9j-v9jp)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-7w82-6f9j-v9jp

影響: npm:mcp-sanitizer < 1.4.0 → 1.4.0
File Path Sanitizer Permits Arbitrary User-Home Absolute Paths Summary mcp-sanitizer v1.3.3 explicitly whitelists /home/ and /Users/ as allowed absolute path prefixes in its file path validation logic (src/utils/validation-utils.js:188-196). As a result, paths such as /home/alice/.ssh/id_rsa and /home/alice/.aws/credentials pass through sanitizer.sanitize() with blocked=false, even though they point to highly sensitive files outside any configured safe root. Any consumer application that trusts…