Executive brief
MCPVault is a tool used to manage and access file vaults. A security flaw allowed users or automated agents to access sensitive internal directories (like .git or .obsidian) if they were located inside subfolders rather than at the top level of the vault. This could lead to the exposure of sensitive information, such as authentication tokens or private configuration data, especially when the tool is used with AI agents susceptible to prompt injection.
Technical details
A path traversal vulnerability exists in MCPVault's PathFilter component due to anchored glob patterns in the deny-list. While the filter correctly blocked access to sensitive directories like .git, .obsidian, and node_modules at the vault root, it failed to restrict access to these same directories when nested within subdirectories (e.g., tools/repo/.git/config). An attacker could exploit this via network-based requests or prompt injection to read sensitive files such as git configurations containing embedded tokens. The issue was resolved in version 0.11.5 by implementing case-insensitive matching for restricted names at any path depth.
Affected products
- bitbonsai @bitbonsai/mcpvault < 0.11.5
Timeline
- 2026-06-18: disclosed
- 2026-06-18: patched: Fixed in version 0.11.5
- 2026-06-19: advisory