Executive brief
mcp-memory-keeper is a tool used to manage memory sessions for Model Context Protocol (MCP) servers. A vulnerability allows an attacker or a compromised AI agent to read sensitive files from the host machine, such as credentials, SSH keys, or other users' data. This could lead to the theft of private information and unauthorized access to other services.
Technical details
The `context_import` function in mcp-memory-keeper fails to validate the `filePath` argument before passing it to `fs.readFileSync`. This lack of path confinement allows for both absolute path referencing and directory traversal (`../`) to access any file readable by the server process. If the target file is valid JSON, the entire content is imported and can be retrieved via `context_get`; if it is not JSON, a snippet of the file's leading bytes is leaked through a V8 `SyntaxError` message. The vulnerability can be triggered by a malicious MCP client or via prompt injection against an LLM agent using the tool. This is fixed in version 0.13.0 by implementing strict path confinement and generic error handling.
Affected products
- mkreyman mcp-memory-keeper < 0.13.0
Timeline
- 2026-06-06: disclosed: Initial report via GitHub issue #35
- 2026-07-17: advisory: GitHub Advisory published
- 2026-07-17: patched: Fixed in version 0.13.0