mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths
影響: npm:mcp-sanitizer < 1.4.0 → 1.4.0
File Path Sanitizer Permits Arbitrary User-Home Absolute Paths Summary mcp-sanitizer v1.3.3 explicitly whitelists /home/ and /Users/ as allowed absolute path prefixes in its file path validation logic (src/utils/validation-utils.js:188-196). As a result, paths such as /home/alice/.ssh/id_rsa and /home/alice/.aws/credentials pass through sanitizer.sanitize() with blocked=false, even though they point to highly sensitive files outside any configured safe root. Any consumer application that trusts…
X で速報を受け取る悪用・大規模な漏洩・障害を、対処法と一緒に。
フォロー @vulnpulse_app| 情報源 | GitHub Advisory Database |
|---|---|
| 取得日時 | 2026/10/29 09:48 |
| データ | Markdown JSON |
2026/10/29 04:51、GitHub Advisory Databaseが「mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js。