{"id":"GHSA-9c83-rr99-vfwj","title":"MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested","summary":"MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested","severity":"medium","cwe":["CWE-22","CWE-538"],"vendor":"bitbonsai","product":"@bitbonsai/mcpvault","ecosystem":"npm","affected":["@bitbonsai/mcpvault < 0.11.5"],"patched":["@bitbonsai/mcpvault 0.11.5"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-9c83-rr99-vfwj","references":[{"url":"https://github.com/bitbonsai/mcpvault/security/advisories/GHSA-9c83-rr99-vfwj"},{"url":"https://github.com/advisories/GHSA-9c83-rr99-vfwj"}],"tags":["ghsa","npm"],"ingestedAt":"2026-06-22T13:35:24.268Z","slug":"GHSA-9c83-rr99-vfwj","body":"## Overview\n\nPathFilter's deny-list glob patterns are anchored, so `.git`, `.obsidian`, and `node_modules` were only blocked at the vault root. Nested copies inside the vault (e.g. `tools/cli/node_modules/...`, `tools/somerepo/.git/config`, a nested `.obsidian/`) were fully traversable via isAllowed/isAllowedForListing. Impact: a nested `.git/config` (remote URLs / embedded tokens) and nested `.obsidian` contents could be read, under the same prompt-injection threat model as GHSA-j99q-93c9-h869 (an attacker influences the path an agent reads). It also caused nested `node_modules` to pollute the tag index (#128, the public symptom). Fixed in 0.11.5 by denying these restricted names at any path depth (matched case-insensitively as any path segment).\n\n## Affected packages\n\n- `@bitbonsai/mcpvault < 0.11.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@bitbonsai/mcpvault 0.11.5`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}