Evidence · DiggingBeagle record
Advisory: lean-ctx MCP save/export file writes escape project jail through unchecked path
The lean-ctx MCP server accepted absolute and parent-relative output paths in save/export tools because its default legacy workspace authority returned user-supplied paths without confinement. GHSA-483j-9vcj-2gxx demonstrates an overwrite outside the approved workspace under normal process filesystem permissions. It identifies 3.12.2 as patched and distinguishes the already confined handoff tool. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
The lean-ctx MCP server accepted absolute and parent-relative output paths in save/export tools because its default legacy workspace authority returned user-supplied paths without confinement. GHSA-483j-9vcj-2gxx demonstrates an overwrite outside the approved workspace under normal process filesystem permissions. It identifies 3.12.2 as patched and distinguishes the already confined handoff tool. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (2)
- supportslean-ctx MCP save and export tools wrote beyond their configured workspace: GHSA-483j-9vcj-2gxx demonstrates an overwrite outside the approved workspace under normal process filesystem permissions. It identifies 3.12.2 as patched and distinguishes the already confined handoff tool.
GHSA-483j-9vcj-2gxx; Authority::Legacy and ctx_package/ctx_pack
- supportslean-ctx MCP save and export tools wrote beyond their configured workspace: The lean-ctx MCP server accepted absolute and parent-relative output paths in save/export tools because its default legacy workspace authority returned user-supplied paths without confinement.
GHSA-483j-9vcj-2gxx; Authority::Legacy and ctx_package/ctx_pack