Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mastra Docs MCP Server `@mastra/mcp-docs-server` Leads to Information Exposure
Vulnerability Description
Mastra is a Typescript framework for building AI agents and assistants. Versions 0.13.8 through 0.13.20-alpha.0 are vulnerable to a Directory Traversal attack that results in the disclosure of directory listings. The code contains a security check to prevent path traversal for reading file contents, but this check is effectively bypassed by subsequent logic that attempts to find directory suggestions. An attacker can leverage this flaw to list the contents of arbitrary directories on the user's filesystem, including the user's home directory, exposing sensitive information about the file system's structure. This issue is fixed in version 0.13.20.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
通过目录枚举导致的信息暴露
Vulnerability Title
Mastra 安全漏洞
Vulnerability Description
Mastra是mastra-ai开源的一个AI代理框架。 Mastra 0.13.8版本至0.13.20-alpha.0版本存在安全漏洞，该漏洞源于安全检查被绕过，可能导致目录遍历攻击。
CVSS Information
N/A
Vulnerability Type
N/A