Description

A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is the function create_system_json/create_library to get_system_json/switch_memory_library of the file src/index.ts. This manipulation causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T04:17:42.917Z",
  "pubdate": "2026-08-09T04:17:42.917Z",
  "executiveSummary": "A path traversal vulnerability has been identified in angrysky56 advanced-reasoning-mcp version 1.0.0. The vulnerability stems from improper input sanitization within specific core functions located in the src/index.ts file. Successfully exploiting this security flaw allows an authenticated or locally positioned adversary to manipulate directory paths, potentially leading to unauthorized read or write access to sensitive files on the underlying host operating system.\nThe affected product is advanced-reasoning-mcp 1.0.0, specifically impacting the create_system_json, create_library, get_system_json, and switch_memory_library functions. The primary risk implication involves unauthorized file system access, which compromises the confidentiality and integrity of the host environment. The attack vector requires local access to the system executing the affected Model Context Protocol (MCP) server instance.\nThe project maintainers were notified of this security issue via an early issue report but have not yet provided an official response or patch. Consequently, organizations utilizing this software must implement compensating controls manually to mitigate potential exploitation risks.",
  "technicalDetails": "The vulnerability resides in the src/index.ts file of advanced-reasoning-mcp 1.0.0, specifically within the input handling logic of the create_system_json, create_library, get_system_json, and switch_memory_library functions. The root cause of the path traversal vulnerability is the direct utilization of untrusted user-supplied input—such as filenames or library identifiers—without adequate validation, canonicalization, or sanitization before passing them into file system operations.\nBecause these functions handle dynamic file paths based on parameters provided during execution, an attacker with local access can supply specially crafted strings containing directory traversal sequences, such as dot-dot-slash (../) patterns. When the application concatenates these malicious inputs with the base directory path, it resolves to locations outside the intended working directory.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies or interacts with the vulnerable MCP functions exposed in src/index.ts. Second, the attacker crafts a payload utilizing directory traversal sequences targeting sensitive configuration files, system data, or application storage paths. Third, the attacker invokes functions such as get_system_json or switch_memory_library with the malicious payload. Fourth, the application processes the unsanitized path and accesses or modifies resources outside the intended sandbox boundary.\nThe exploitation prerequisites dictate that the attacker must possess local access to the system running the advanced-reasoning-mcp server. Depending on the execution context and the specific function targeted, the post-exploitation impact includes unauthorized retrieval of system configuration files, arbitrary file creation, or manipulation of memory libraries, which may lead to broader system compromise or data leakage."
}