File Path Vulnerability in MCP Memory Keeper by mkreyman

CVE-2026-54561

What is CVE-2026-54561?

The MCP Memory Keeper, designed for persistent context management in AI coding assistants, is affected by a vulnerability in the context_import function. This function allows an attacker to manipulate the file path used in fs.readFileSync, which is utilized without prior validation. By leveraging path traversal techniques or absolute paths, a malicious client can access any file that the server process can read. This could lead to the exposure of sensitive information, including credentials and SSH keys, when valid JSON files are imported into the caller's session. Furthermore, if non-JSON files are targeted, leading bytes may be revealed through SyntaxError messages. The issue has been addressed in version 0.13.0.

References