Homepage

mcp-memory-service@10.24.0 vulnerabilities

Open-source persistent memory for AI agent pipelines and Claude. REST API + semantic search + knowledge graph + autonomous consolidation. Self-host, zero cloud cost.

  • latest version

    10.26.4

  • latest non vulnerable version

    10.26.4

  • first published

    4 months ago

  • latest version published

    9 hours ago

  • licenses detected

  • View mcp-memory-service package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the mcp-memory-service package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Permissive Cross-domain Policy with Untrusted Domains

    mcp-memory-service is an Open-source persistent memory for AI agent pipelines and Claude. REST API + semantic search + knowledge graph + autonomous consolidation. Self-host, zero cloud cost.

    Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the create_app CORSMiddleware setup in src/mcp_memory_service/web/app.py that defaults MCP_CORS_ORIGINS to wildcard origins and leaves allow_credentials enabled. An attacker can exfiltrate and tamper with all stored memory by hosting malicious JavaScript that issues cross-origin fetches, since the service responds with Access-Control-Allow-Origin: * and honors anonymous requests.

    How to fix Permissive Cross-domain Policy with Untrusted Domains?

    Upgrade mcp-memory-service to version 10.25.1 or higher.

    [,10.25.1)
    Go back to all versions of this package