lean-ctx MCP save and export tools wrote beyond their configured workspace

The lean-ctx MCP server accepted absolute and parent-relative output paths in save/export tools because its default legacy workspace authority returned user-supplied paths without confinement.

GHSA-483j-9vcj-2gxx demonstrates an overwrite outside the approved workspace under normal process filesystem permissions. It identifies 3.12.2 as patched and distinguishes the already confined handoff tool.

lean-ctx's legacy workspace authority did not confine every tool that created a file. In ctx_package save and ctx_pack export, the authorization helper returned absolute and parent-relative output paths without a final owned-workspace check. The advisory demonstrates writing to a sibling repository while a separate handoff feature already implemented confinement. This difference matters: patching one path-producing tool does not prove all exposed MCP methods now share the same enforcement. The published fixed release is 3.12.2. The demonstrated effect is an out-of-workspace write under the MCP process's operating-system privileges, not arbitrary privileged code execution.

The boundary failure sits in a shared path-confinement helper, but its consequences depend on which MCP tool calls it. Under the reported legacy authority mode, save and export routes accepted paths that could leave the project workspace; another route already enforced confinement. A patch that fixes only one tool leaves alternative file-producing routes open. The result is a file-write escape within the server's operating-system permissions, not independent proof that an arbitrary executable was launched.