{"id":"CVE-2026-54561","aliases":["GHSA-f7wf-v2vw-mpcx"],"url":"https://o3.security/vulnerability/CVE-2026-54561","summary":"MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath","details":"### Impact\n\n`context_import` passed the caller-supplied `filePath` directly to `fs.readFileSync` with no path confinement. A malicious MCP client — or an LLM agent that is prompt-injected into calling the tool — could point `filePath` at **any file readable by the server process**, outside any session or export directory:\n\n- **Full disclosure (JSON files):** a valid-JSON target (e.g. another user's exported session, or a `*.json` credential / service-account file) is parsed and imported into the caller's session, then retrievable verbatim via `context_get` / `context_export`.\n- **Partial disclosure (any file):** for a non-JSON target (e.g. `/etc/passwd`, an SSH key, a `.env`), `JSON.parse` throws and V8 includes a snippet of the file's leading bytes in the `SyntaxError` message, which was returned verbatim to the caller.\n\nBoth `../` traversal and absolute paths worked — there was no path confinement of any kind.\n\nIn a typical MCP deployment the server runs on the developer's machine, so the reachable set includes other users' exported memory sessions, JSON credential/config files, and (in leading-bytes form) `.env` files, SSH keys, and `/etc/passwd`. The trigger is a tool argument, so the realistic threat model is an LLM agent prompt-injected into calling `context_import`, or any MCP client connected to the server.\n\n### Patches\n\nFixed in **0.13.0** (PR #36):\n\n- Imports are confined to a server-owned exports directory (`<DATA_DIR>/exports`, overridable via `MEMORY_KEEPER_EXPORT_DIR`), resolved with `realpathSync`. `../` traversal, absolute paths outside the directory, and symlink escapes are all rejected.\n- File read and `JSON.parse` are separate operations; read/parse failures return a generic message and never echo file bytes (the `SyntaxError`-message leak is gone). The database-write path is likewise generic.\n- An E2E security regression suite covers the reported arbitrary-read and traversal vectors, plus symlink escape, the directory-prefix boundary, and a no-existence-oracle check.\n\n### Workarounds\n\nUpgrade to **`>= 0.13.0`**. There is no configuration-only workaround for affected versions.\n\n### Resources\n\n- Report: GitHub issue #35\n- Fix: PR #36\n\n### Credit\n\nReported by Zhihao Zhang ([@mcfly-zzh](https://github.com/mcfly-zzh)).","published":"2026-09-15T16:32:01.307Z","modified":"2026-10-21T02:58:34.478870551Z","cvss":{"score":6.2,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00297,"percentile":0.22426,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"mcp-memory-keeper","fixedVersion":"0.13.0"}],"fix":{"url":"https://github.com/mkreyman/mcp-memory-keeper/commit/58640c22e037572e0b03bc0aa25d015ea98dcc6d","label":"mkreyman/mcp-memory-keeper@58640c2"},"references":[{"type":"WEB","url":"https://github.com/mkreyman/mcp-memory-keeper/releases/tag/v0.13.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54561.json"},{"type":"ADVISORY","url":"https://github.com/mkreyman/mcp-memory-keeper/security/advisories/GHSA-f7wf-v2vw-mpcx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54561"},{"type":"REPORT","url":"https://github.com/mkreyman/mcp-memory-keeper/issues/35"},{"type":"FIX","url":"https://github.com/mkreyman/mcp-memory-keeper/commit/58640c22e037572e0b03bc0aa25d015ea98dcc6d"},{"type":"FIX","url":"https://github.com/mkreyman/mcp-memory-keeper/commit/b9369568468007c85f8aec3ae09ca6f611285bc5"},{"type":"FIX","url":"https://github.com/mkreyman/mcp-memory-keeper/commit/e0ab521a9e8343bcab1ca60ccc3601e4d86eaa97"},{"type":"FIX","url":"https://github.com/mkreyman/mcp-memory-keeper/pull/36"},{"type":"WEB","url":"https://github.com/mkreyman/mcp-memory-keeper/commit/84f6dfa692736a34ff36e2d2cf2188b71facf73b"},{"type":"PACKAGE","url":"https://github.com/mkreyman/mcp-memory-keeper"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:34.478870551Z"}}