---
id: GHSA-9c83-rr99-vfwj
title: >-
  MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only
  denied at vault root, not nested
summary: >-
  MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only
  denied at vault root, not nested
severity: medium
cwe:
  - CWE-22
  - CWE-538
vendor: bitbonsai
product: '@bitbonsai/mcpvault'
ecosystem: npm
affected:
  - '@bitbonsai/mcpvault < 0.11.5'
patched:
  - '@bitbonsai/mcpvault 0.11.5'
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-9c83-rr99-vfwj'
references:
  - url: >-
      https://github.com/bitbonsai/mcpvault/security/advisories/GHSA-9c83-rr99-vfwj
  - url: 'https://github.com/advisories/GHSA-9c83-rr99-vfwj'
tags:
  - ghsa
  - npm
ingestedAt: '2026-06-22T13:35:24.268Z'
---

## Overview

PathFilter's deny-list glob patterns are anchored, so `.git`, `.obsidian`, and `node_modules` were only blocked at the vault root. Nested copies inside the vault (e.g. `tools/cli/node_modules/...`, `tools/somerepo/.git/config`, a nested `.obsidian/`) were fully traversable via isAllowed/isAllowedForListing. Impact: a nested `.git/config` (remote URLs / embedded tokens) and nested `.obsidian` contents could be read, under the same prompt-injection threat model as GHSA-j99q-93c9-h869 (an attacker influences the path an agent reads). It also caused nested `node_modules` to pollute the tag index (#128, the public symptom). Fixed in 0.11.5 by denying these restricted names at any path depth (matched case-insensitively as any path segment).

## Affected packages

- `@bitbonsai/mcpvault < 0.11.5`

## Remediation

Upgrade to a patched release:

- `@bitbonsai/mcpvault 0.11.5`