A critical path traversal vulnerability in the edvardlindelof notes-mcp library allows unauthenticated remote attackers to read, write, or delete arbitrary files on the host system.

The application incorrectly handles user-supplied file paths by concatenating them to a base directory without validation or resolution. This allows an unauthenticated attacker to use directory traversal sequences (../) to escape the intended note vault and interact with any file accessible by the service account.

The vulnerability poses a severe risk to confidentiality, integrity, and availability. An attacker can read sensitive system files, overwrite configuration files to achieve further compromise, or delete critical data, leading to potential system downtime or total loss of control over the affected service. Given the CVSS score of 7.3 and the nature of the flaw, this must be treated as a high-priority risk for any environment running this software.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the MCP server to trusted local networks only. If the functionality is not strictly required, disable the service until a secure version is released by the maintainer.

Proactive Monitoring: Review system and application logs for unusual file access patterns, specifically looking for requests containing directory traversal sequences like ../ in tool arguments.

Compensating Controls: Deploy the service within a containerized environment with strictly limited filesystem permissions (read-only root filesystem) and no access to sensitive host directories to minimize the impact of a successful escape.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the official GitHub issue tracker for the project.

The absence of a vendor-provided patch necessitates immediate defensive action to isolate the vulnerable component. Organizations utilizing notes-mcp must prioritize restricting network access or disabling the tool to prevent remote exploitation. Monitor the official repository for updates and apply the fix as soon as it becomes available.