AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-f7wf-v2vw-mpcx: mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath

mediumvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseJuly 17, 2026CVE-2026-54561

Summary

A security flaw in mcp-memory-keeper allowed arbitrary local file reads through the `context_import` function, which didn't validate file paths before reading them. An attacker (either a malicious client or an LLM agent affected by prompt injection, a technique where hidden instructions are embedded in AI inputs) could read any file accessible to the server process, including credential files and configuration files, or view partial file contents through error messages.

Solution / Mitigation

Fixed in version 0.13.0 (PR #36). The patch: (1) restricts imports to a server-owned exports directory using `realpathSync` and rejects `../` traversal and absolute paths outside the directory, (2) separates file read and JSON parsing operations with generic error messages instead of echoing file bytes, and (3) adds security regression tests covering arbitrary-read, traversal, and symlink escape vectors. Users must upgrade to version >= 0.13.0; there is no configuration-only workaround for affected versions.