Skip to content

PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

Moderate
bitbonsai published GHSA-j99q-93c9-h869 Jun 17, 2026

Package

npm @bitbonsai/mcpvault (npm)

Affected versions

< 0.11.4

Patched versions

0.11.4

Description

On case-insensitive filesystems (macOS, Windows), PathFilter compiled its deny-list patterns case-sensitively and matched the path verbatim, so names like .Git/config, .GIT/config, or .oBsIdIaN/secrets.md slipped past the .git/.obsidian/node_modules restriction while the OS opened the real file. On Windows, trailing dots/spaces (.git./config, .git /config) bypassed it the same way. Affects both isAllowed (read/write/move/search) and isAllowedForListing. Vault-root .. containment is NOT affected. Fixed in 0.11.4 by case-insensitive matching plus per-segment canonicalization before the deny-list check. Reported privately by novice-22.

Severity

Moderate

CVE ID

CVE-2026-57441

Weaknesses

Improper Resolution of Path Equivalence

The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object. Learn more on MITRE.

Improper Handling of Case Sensitivity

The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results. Learn more on MITRE.