Homepage

Directory Traversal Affecting mcp-mongodb package, versions <3.1.0-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.81% (56th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-MCPMONGODB-21177417
  • published18 Oct 2026
  • disclosed28 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 28 Sep 2026

NewCVE-2026-101894  (opens in a new tab)
CWE-22  (opens in a new tab)
CWE-59  (opens in a new tab)

How to fix?

Upgrade Minimos:latest mcp-mongodb to version 3.1.0-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mcp-mongodb package and not the mcp-mongodb package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink entries so that a later entry resolves outside the output directory. This allows files outside output to be read or written, and overwriting startup scripts or configuration can lead to remote code execution. The maintained @xhmikosr/decompress package is fixed in 10.2.2 and 11.1.4, but the separately affected unmaintained decompress package remains unpatched through 4.2.1. This vulnerability results from a bypass of the incomplete hardening for CVE-2026-53486. @xhmikosr/decompress is fixed in versions 10.2.2 and 11.1.4.