{"data":{"id":"8cc8330f-fc1a-4faf-a805-4642a7efc423","title":"CVE-2025-61685: Mastra is a Typescript framework for building AI agents and assistants. Versions 0.13.8 through 0.13.20-alpha.0 are…","summary":"Mastra, a TypeScript framework for building AI agents and assistants, is vulnerable in versions 0.13.8 through 0.13.20-alpha.0 to directory traversal. A path traversal check that protects reading file contents is bypassed by later logic that generates directory suggestions, letting an attacker list arbitrary directories on the user's filesystem, including the home directory, and expose details of the file system's structure.","solution":"This issue is fixed in version 0.13.20.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-61685","publishedAt":"2025-10-03T23:15:29.870Z","cveId":"CVE-2025-61685","cweIds":["CWE-548"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@mastra/mcp-docs-server@<= 0.13.8 (fixed: 0.17.0)"],"affectedPackageNames":["@mastra/mcp-docs-server"],"affectedPackageRefs":["npm:@mastra/mcp-docs-server"],"affectedVendors":[],"affectedVendorsRaw":["Mastra"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Mastra directory traversal disclosing directory listings","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00594,"epssCheckedAt":"2026-11-04T12:08:34.077Z","kevDateAdded":null,"advisoryAliases":["GHSA-xh92-rqrq-227v"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:24.481Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:43:32.666Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@mastra/mcp-docs-server","fixedVersion":"0.17.0","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":"registry","status":"version_not_found","checkedAt":"2026-10-29T21:43:32.515Z"}]}}