{"id":"GHSA-9c83-rr99-vfwj","summary":"MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested","details":"PathFilter's deny-list glob patterns are anchored, so `.git`, `.obsidian`, and `node_modules` were only blocked at the vault root. Nested copies inside the vault (e.g. `tools/cli/node_modules/...`, `tools/somerepo/.git/config`, a nested `.obsidian/`) were fully traversable via isAllowed/isAllowedForListing. Impact: a nested `.git/config` (remote URLs / embedded tokens) and nested `.obsidian` contents could be read, under the same prompt-injection threat model as GHSA-j99q-93c9-h869 (an attacker influences the path an agent reads). It also caused nested `node_modules` to pollute the tag index (#128, the public symptom). Fixed in 0.11.5 by denying these restricted names at any path depth (matched case-insensitively as any path segment).","aliases":["CVE-2026-57442"],"modified":"2026-07-20T21:56:45.025308Z","published":"2026-06-19T21:42:24Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-06-19T21:42:24Z","nvd_published_at":null,"cwe_ids":["CWE-22","CWE-538"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/bitbonsai/mcpvault/security/advisories/GHSA-9c83-rr99-vfwj"},{"type":"PACKAGE","url":"https://github.com/bitbonsai/mcpvault"}],"affected":[{"package":{"name":"@bitbonsai/mcpvault","ecosystem":"npm","purl":"pkg:npm/%40bitbonsai/mcpvault"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.11.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9c83-rr99-vfwj/GHSA-9c83-rr99-vfwj.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}