Zero Radar
← feed
HighVulnerabilityGHSA-7w82-6f9j-v9jpupdated 28 Oct 2026, 19:52 UTC

mcp-sanitizer lets attackers reach private keys in user home folders

A tool meant to block risky file paths allows anything inside user home folders, so an attacker sending one web request could read a stored SSH key or cloud password file if the app uses the result.

Fixed in mcp-sanitizer 1.4.0Official source
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesmcp-sanitizer 1.4.0 · since 28 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted file_path sent over HTTP
  2. 2Sanitizer accepts path/home/ prefix is whitelisted
  3. 3App reads fileConsumer trusts the sanitized path
  4. 4Secrets returnedSSH keys and AWS credentials exposed
  5. ResultAttacker reads private keys and credentials

What happened

mcp-sanitizer v1.3.3 whitelists /home/ and /Users/ as allowed absolute path prefixes in validateFilePath, so sensitive files such as ~/.ssh/id_rsa and ~/.aws/credentials pass sanitization unblocked.

Why it is dangerous: Any consumer app that trusts the sanitized path and passes it to a file read or write can expose private keys and credentials to an unauthenticated network attacker; dynamic reproduction confirmed exfiltration via a single HTTP POST.

Are you affected?

You are affected if you use mcp-sanitizer below 1.4.0 and pass its sanitized file_path output to filesystem reads or writes.

Package / productAffected versionsFixed in
mcp-sanitizer · npm< 1.4.01.4.0

What to do

  1. Update mcp-sanitizer to 1.4.0 or later
  2. Do not trust sanitized file paths for file reads or writes until patched
  3. Review logs for file_reader or file_writer requests targeting home-directory paths

Timeline

  1. 28 Oct 2026, 19:51 UTC
    Publicly disclosed
  2. 28 Oct 2026, 19:51 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 28 Oct 2026, 19:52 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-7w82-6f9j-v9jp
CVSS
7.5 / 10
Disclosed
28 Oct 2026, 19:51 UTC
On Zero Radar
28 Oct 2026, 19:52 UTC (1 min after disclosure)
Last change
28 Oct 2026, 19:52 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

mcp-sanitizer lets attackers reach private keys in user home folders · Zero Radar