GHSA-j99q-93c9-h869
NoneCVSS
—
EPSS
—
Published
Jun 18, 2026
CISA due date
—
The record
MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @bitbonsai/mcpvault | 0 | 0.11.4 |
Related vulnerabilities
- GHSA-9c83-rr99-vfwj MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at… Also affects @bitbonsai/mcpvault
- CVE-2026-86472 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. CWE-178
- CVE-2026-87876 Two case-insensitive comparisons on request-derived usernames outside the main… CWE-178
- CVE-2026-84428 fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names… CWE-178
- CVE-2026-84303 gRPC-Go is the Go language implementation of gRPC. CWE-178
- CVE-2026-83612 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-178
- CVE-2026-73270 Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a… CWE-178
- CVE-2026-82726 Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote… CWE-178