Executive brief
memory-graph is an MCP server that provides persistent memory and knowledge graph capabilities for AI assistants. A path traversal vulnerability allows a malicious MCP client to read, create, and overwrite arbitrary JSON files outside the intended storage directory by crafting a domain ID containing traversal sequences (e.g., "../"), potentially compromising stored conversation history and system integrity.
Technical details
This is a path traversal vulnerability in the JsonMemoryStorage class of src/tools/memoryTools.ts. The root cause is that domain IDs provided by MCP clients are used directly in path.join() operations without validation, allowing traversal sequences like "../" to escape the intended memoriesDir. The vulnerable functions are createDomain(), getMemories(), and saveMemories(), all of which build file paths by concatenating the unsanitized domain ID. An attacker with local access to the MCP interface can craft malicious domain IDs to read arbitrary JSON files from the system or overwrite files outside the storage directory. The project operates on a rolling release basis and has not yet responded to the reported issue.
Affected products
- aaronsb memory-graph up to commit 5cfd2382778837b9f6399080956eee670d00452c
Timeline
- 2026-04-27: disclosed: Vulnerability reported via GitHub issue #14
- 2026-08-08: advisory: CVE-2026-19285 published on NVD