CVE-2026-57442: MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and nodemodules path segments do not match the restriction and pass both isAllowed() and isAllowedForListing(). An attacker who influences a path selected by an AI agent can traverse nested repository or Obsidian metadata, read remote URLs or embedded tokens, or cause nested nodemodules content to pollute the listAllTags index. This issue is fixed in version 0.11.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCPVaultto a version that resolves this vulnerability.Fixed in 0.11.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
MCPVault deployments running a version prior to 0.11.5 are exposed when their vault contains nested .git, .obsidian, or node_modules directories and an AI agent can be influenced to select paths within them.
What can an attacker access or affect?
An attacker able to influence an AI agent's path selection may read files in nested repository or Obsidian metadata directories, including remote URLs or embedded tokens. Nested node_modules content can also be included in the listAllTags index.
Are restricted directories protected by the default path filter?
Only .git, .obsidian, and node_modules directories located at the vault root are denied by the affected PathFilter behavior. Matching directories nested below the vault root pass both isAllowed() and isAllowedForListing().
How can I determine whether my deployment needs remediation?
Check the MCPVault version and upgrade if it is earlier than 0.11.5. Also inspect the vault for nested .git, .obsidian, or node_modules directories, especially where agents may be directed to choose file paths.