GHSA-9c83-rr99-vfwj
MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @bitbonsai/mcpvault | < 0.11.5 | 0.11.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
PathFilter's deny-list glob patterns are anchored, so `.git`, `.obsidian`, and `node_modules` were only blocked at the vault root. Nested copies inside the vault (e.g. `tools/cli/node_modules/...`, `tools/somerepo/.git/config`, a nested `.obsidian/`) were fully traversable via isAllowed/isAllowedForListing. Impact: a nested `.git/config` (remote URLs / embedded tokens) and nested `.obsidian` contents could be read, under the same prompt-injection threat model as GHSA-j99q-93c9-h869 (an attacker influences the path an agent reads). It also caused nested `node_modules` to pollute the tag index (#128, the public symptom). Fixed in 0.11.5 by denying these restricted names at any path depth (matched case-insensitively as any path segment).
References
External links from the advisory. They lead to third-party sites.