CVE-2026-57442: MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5,

MCPVault, a server that lets AI safely access files in an Obsidian vault (a note-taking app), had a security flaw before version 0.11.5 where its path filter (the code that blocks access to certain folders) only blocked top-level restricted folders like .git and node_modules. An attacker could bypass this by accessing these same folders when they were nested deeper in the directory structure, potentially exposing sensitive files, tokens (credentials used for authentication), or corrupting search indexes.