Description
A security vulnerability has been detected in edvardlindelof notes-mcp up to 0.1.4. This affects an unknown function of the file notes_mcp.py. The manipulation of the argument root_dir/path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
References (5)
Core 5
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-359808 | edvardlindelof notes-mcp notes_mcp.py path traversal
https://vuldb.com/vuln/359808
Signature, Permissions Required signature
permissions-required
VDB-359808 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/359808/cti
Third Party Advisory third-party-advisory
Submit #802084 | edvardlindelof notes-mcp 0.1.4 Path Traversal
https://vuldb.com/submit/802084
Exploit exploit
issue-tracking
https://github.com/edvardlindelof/notes-mcp/issues/2
Product product
https://github.com/edvardlindelof/notes-mcp/
Scores
CVSS v3
7.3
EPSS
0.0041
EPSS Percentile
32.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (6)
edvardlindelof/notes-mcp
0.1.0
edvardlindelof/notes-mcp
0.1.1
edvardlindelof/notes-mcp
0.1.2
edvardlindelof/notes-mcp
0.1.3
edvardlindelof/notes-mcp
0.1.4
pypi/notes-mcp
0 - 0.1.4PyPI
Published
Apr 28, 2026
Tracked Since
Apr 28, 2026