PT-2026-53141 · Npm · @Bitbonsai/Mcpvault

Publicado 2026-06-18 · Atualizado 2026-06-18

OSV

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

On case-insensitive filesystems (macOS, Windows), PathFilter compiled its deny-list patterns case-sensitively and matched the path verbatim, so names like .Git/config, .GIT/config, or .oBsIdIaN/secrets.md slipped past the .git/.obsidian/node modules restriction while the OS opened the real file. On Windows, trailing dots/spaces (.git./config, .git /config) bypassed it the same way. Affects both isAllowed (read/write/move/search) and isAllowedForListing. Vault-root .. containment is NOT affected. Fixed in 0.11.4 by case-insensitive matching plus per-segment canonicalization before the deny-list check. Reported privately by novice-22.

Correção

Enumeração de Fraquezas

CWE-41

CWE-178

Identificadores relacionados

GHSA-J99Q-93C9-H869

Produtos afetados

@Bitbonsai/Mcpvault

Referências · 3

• https://github.com/bitbonsai/mcpvault · Nota
• https://github.com/bitbonsai/mcpvault/security/advisories/GHSA-j99q-93c9-h869 · Nota
• https://osv.dev/vulnerability/GHSA-j99q-93c9-h869 · Aviso do Fabricante