Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-27 · source-backed
Published to NVD and GitHub Security Advisories on August 27, this is a traversal in read_context in src/index.ts of bsmi021 mcp-file-context-server 1.0.0, remotely exploitable via the path argument, rated 5.5 MEDIUM (NVD). NVD's text notes the project was informed early through an issue report and the exploit is now public. A file-reading MCP server with a live traversal and no fix is a short path from prompt injection to arbitrary file disclosure.
Each link below shares sources, entities, or timing with this story.
PraisonAI uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (PraisonAI uses MCP); both cover August, CVE, MCP, NVD; reported by the same outlet (nvd.nist.gov).
MCP uses Docker / Shared entities / Earlier coverage
Linked by a graph relationship (MCP uses Docker); both cover August, CVE, MCP; earlier August coverage from 2026-08-21.
OpenAI supports MCP / Shared entities / Earlier coverage
Linked by a graph relationship (OpenAI supports MCP); both cover August, CVE, NVD; earlier August coverage from 2026-08-09.
Codex CLI uses MCP / Shared entities / Earlier coverage
Linked by a graph relationship (Codex CLI uses MCP); both cover August, CVE, MCP; earlier August coverage from 2026-08-07.
Claude uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude uses MCP); both cover August, MCP; overlapping topics (argument, august).
Claude Code uses MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover CVE, NVD; reported by the same outlet (nvd.nist.gov).
Claude Code uses MCP / Shared entities / Earlier coverage / Tension
Linked by a graph relationship (Claude Code uses MCP); both cover August, MCP; earlier August coverage from 2026-08-23.
VS Code supports MCP / Shared entities / Earlier coverage / Tension
Linked by a graph relationship (VS Code supports MCP); both cover August, MCP; earlier August coverage from 2026-08-23.