mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths
影響: npm:mcp-sanitizer < 1.4.0 → 1.4.0
File Path Sanitizer Permits Arbitrary User-Home Absolute Paths Summary mcp-sanitizer v1.3.3 explicitly whitelists /home/ and /Users/ as allowed absolute path prefixes in its file path validation logic (src/utils/validation-utils.js:188-196). As a result, paths such as /home/alice/.ssh/id_rsa and /home/alice/.aws/credentials pass through sanitizer.sanitize() with blocked=false, even though they point to highly sensitive files outside any configured safe root. Any consumer application that trusts…
X에서 속보 받기악용·대형 유출·장애를 대응 방법과 함께.
팔로우 @vulnpulse_app| 정보원 | GitHub Advisory Database |
|---|---|
| 수집 시각 | 2026. 10. 29. 오전 09:48 |
| 데이터 | Markdown JSON |
2026. 10. 29. 오전 04:51, GitHub Advisory Database에서 "mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js.