CVE-2026-57441

MCPVault, a Model Context Protocol server that gives AI agents sandboxed file access inside an Obsidian vault, fails to block restricted directories in versions prior to 0.11.4 because its PathFilter (src/pathfilter.ts) matches patterns like .git, .obsidian, and node_modules case-sensitively and compares paths without canonicalizing filesystem-equivalent names. On case-insensitive macOS and Windows filesystems, simply varying the case of a directory name (e.g., '.GIT') lets it pass both isAllowed() and isAllowedForListing() checks even though the OS still resolves it to the restricted directory; Windows 8.3-style trailing dots or spaces in a segment achieve the same bypass. An attacker who can influence a path chosen by the AI agent (for example via prompt injection in vault content) can use read, write, move, search, or listing operations to expose or tamper with Git history, Obsidian configuration, and node_modules contents — though vault-root '..' containment is not affected, so this is not a vault-escape primitive. The flaw is rated CVSS 4.0 high (8.4) because successful exploitation yields high confidentiality and integrity impact with no privileges, but requires user interaction with a local agent session. It is fixed in version 0.11.4; no public proof of concept exists and no exploitation has been observed.

What to do: Upgrade MCPVault to version 0.11.4 or later immediately, especially on macOS or Windows where the case-insensitivity bypass applies. Review agent session logs and vault contents for any past operations referencing case variants of .git, .obsidian, or node_modules (or Windows paths with trailing dots/spaces) to check for metadata disclosure or tampering. As defense in depth, treat untrusted vault content as a prompt-injection vector that can steer agent-selected paths, and keep the vault-root '..' containment verified since that boundary is not affected by this flaw.