Homepage

@bitbonsai/mcpvault@0.11.3

Universal AI bridge for Obsidian vaults - connect any MCP-compatible assistant

  • latest version

    0.12.1

  • latest non vulnerable version

    0.12.1

  • first published

    3 months ago

  • latest version published

    16 days ago

  • licenses detected

  • View mcpvault package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @bitbonsai/mcpvault package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Insertion of Sensitive Information into Externally-Accessible File or Directory

    @bitbonsai/mcpvault is an Universal AI bridge for Obsidian vaults - connect any MCP-compatible assistant

    Affected versions of this package are vulnerable to Insertion of Sensitive Information into Externally-Accessible File or Directory in the PathFilter process. An attacker can access sensitive files and directories, such as nested .git/config files containing remote URLs or embedded tokens, and contents of nested .obsidian directories, by influencing the path that an agent reads. This allows unauthorized disclosure of confidential information located in restricted directories at any depth within the vault.

    How to fix Insertion of Sensitive Information into Externally-Accessible File or Directory?

    Upgrade @bitbonsai/mcpvault to version 0.11.5 or higher.

    <0.11.5
    • M
    Improper Handling of Case Sensitivity

    @bitbonsai/mcpvault is an Universal AI bridge for Obsidian vaults - connect any MCP-compatible assistant

    Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the PathFilter process. An attacker can gain unauthorized access to restricted directories and files by exploiting case-insensitive matching and trailing dot or space equivalence on certain filesystems, such as macOS and Windows, thereby bypassing deny-list restrictions.

    How to fix Improper Handling of Case Sensitivity?

    Upgrade @bitbonsai/mcpvault to version 0.11.4 or higher.

    <0.11.4
    Go back to all versions of this package