CVE-2026-54561

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54561

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54561.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54561

Aliases

GHSA-f7wf-v2vw-mpcx

Published

2026-09-15T16:32:01Z

Modified

2026-09-16T03:46:35Z

Severity

6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath

Details

MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller-controlled filePath directly to fs.readFileSync without restricting the path to an export directory. An MCP client, including an LLM agent induced to call the tool, can use ../ traversal or an absolute path to target any file readable by the server process. A valid JSON file is parsed and imported into the caller's session, allowing its full contents to be retrieved through context_get or context_export, while JSON.parse errors for non-JSON files can return leading file bytes in a SyntaxError message. The two disclosure modes can expose other exported sessions, JSON credentials or service-account files, environment files, and portions of SSH keys or other local files. This issue is fixed in version 0.13.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-209",
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54561.json"
}

References

Affected packages

Git / github.com/mkreyman/mcp-memory-keeper

Affected ranges

Type

GIT

Repo

https://github.com/mkreyman/mcp-memory-keeper

Events

Introduced

Fixed

84f6dfa692736a34ff36e2d2cf2188b71facf73b

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.13.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.10.2

v0.11.0

v0.12.0

v0.12.1

v0.12.2

v0.8.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54561.json"