bitbonsai has 4 CVEs on record. 2 were published in the last 90 days. The median CVSS is 7.7 (high). Most affected products: @bitbonsai/mcpvault (2), mcpvault (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.7
- Publish → KEV
- —
- Last 90 days
- 2 prev 2
Worst active — by depth score
CVE-2026-57442Medium· 6.9MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault50CVE-2026-57441High· 8.4MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault46GHSA-9c83-rr99-vfwjMediumMCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested28GHSA-j99q-93c9-h869MediumMCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence28
bitbonsai vulnerabilities
CVEs affecting bitbonsai, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-57442Medium· 6.9PoCMCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and node_modules pa…
CVE-2026-57441High· 8.4MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without ca…
GHSA-9c83-rr99-vfwjMediumMCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested
MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested
GHSA-j99q-93c9-h869MediumMCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence
MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence