{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mcp-sanitizer-v1.3.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mcp-sanitizer (v1.3.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe mcp-sanitizer library v1.3.3 contains a critical path traversal vulnerability (CWE-22) in its \u003ccode\u003evalidateFilePath\u003c/code\u003e function within \u003ccode\u003esrc/utils/validation-utils.js\u003c/code\u003e. The library implementation includes an overly permissive allowlist for absolute file paths, explicitly permitting any path starting with \u003ccode\u003e/home/\u003c/code\u003e or \u003ccode\u003e/Users/\u003c/code\u003e. Consequently, security validation fails to block access to highly sensitive files such as SSH keys, AWS credentials, and Kubernetes configurations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a POST request to an MCP-enabled application using the \u003ccode\u003emcp-sanitizer\u003c/code\u003e middleware.\u003c/li\u003e\n\u003cli\u003eThe application passes an attacker-supplied \u003ccode\u003efile_path\u003c/code\u003e to \u003ccode\u003esanitizer.sanitize()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003evalidateFilePath\u003c/code\u003e function normalizes the input and performs an allowlist check.\u003c/li\u003e\n\u003cli\u003eBecause the malicious path (e.g., \u003ccode\u003e/home/victim/.ssh/id_rsa\u003c/code\u003e) matches the hardcoded \u003ccode\u003e/home/\u003c/code\u003e prefix, the validator returns \u003ccode\u003eblocked=false\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe library returns the path to the consumer application as a \u0026quot;trusted\u0026quot; sanitized value.\u003c/li\u003e\n\u003cli\u003eThe consumer application, trusting the sanitizer's output, performs a filesystem read operation (e.g., \u003ccode\u003efs.readFile\u003c/code\u003e) on the attacker-controlled path.\u003c/li\u003e\n\u003cli\u003eThe application returns the contents of the sensitive file to the attacker in the HTTP response.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to exfiltrate sensitive user-home directory files, including SSH private keys, cloud provider credentials, and application tokens. This results in complete confidentiality loss for the affected user's data and potential lateral movement into cloud infrastructure or remote systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate any application utilizing \u003ccode\u003emcp-sanitizer\u003c/code\u003e to implement strict path validation that excludes sensitive home directory sub-paths, even if the library is not updated.\u003c/li\u003e\n\u003cli\u003eImplement a secondary layer of path validation in the application logic that explicitly denies access to \u003ccode\u003e.ssh\u003c/code\u003e, \u003ccode\u003e.aws\u003c/code\u003e, \u003ccode\u003e.gnupg\u003c/code\u003e, \u003ccode\u003e.kube\u003c/code\u003e, \u003ccode\u003e.config\u003c/code\u003e, and \u003ccode\u003e.env\u003c/code\u003e files regardless of the sanitizer output.\u003c/li\u003e\n\u003cli\u003eAudit all MCP server implementations for dependencies on \u003ccode\u003emcp-sanitizer\u003c/code\u003e and restrict access to the \u003ccode\u003e/tool\u003c/code\u003e endpoint to authenticated and authorized users only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T00:17:51Z","date_published":"2026-10-29T00:17:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mcp-sanitizer-path-traversal/","summary":"The mcp-sanitizer library v1.3.3 permits path traversal by whitelisting /home/ and /Users/ in its validation logic, allowing unauthenticated attackers to read sensitive user configuration files.","title":"mcp-sanitizer: Path Traversal via Improper Home Directory Validation","url":"https://feed.craftedsignal.io/briefs/2026-10-mcp-sanitizer-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Mcp-Sanitizer (V1.3.3)","version":"https://jsonfeed.org/version/1.1"}