better-icons MCP server allows out-of-scope file writes and source-code injection via sync_icon

Vulnerability Overview Title: [Potential Vulnerability] better-icons sync_icon allows out-of-scope file writes and source-code injection #18 Description: Tool: is an MCP server used for searching icons and generating icon components. Vulnerability: The tool allows writing the generated component source to an path provided by the caller, and creates missing parent directories. If the target file already exists, it is read and rewritten. Furthermore, accepts a parameter that is directly inserted into the generated JavaScript/TypeScript/Vue/Svelte/Solid source files. If not validated as an identifier, the caller can inject raw source code into the generated files. Impact: An attacker can read arbitrary files, create or modify arbitrary paths, and inject arbitrary JavaScript/TypeScript source code via MCP clients, prompt injection, or malicious tool calls. Scope of Impact Threat Model: An attacker can read arbitrary files, create or modify arbitrary paths, and inject arbitrary JavaScript/TypeScript source code via MCP clients, prompt injection, or malicious tool calls. Direct Impact: Creation/modification of source files controlled by the attacker, with code execution occurring when the victim's project later imports, builds, or runs the code. Remediation 1. Path Safety: - Parse the provided path. - Verify that it resides within the configured root directory. - Reject absolute paths involving traversal or escaping the root directory. - Enforce allowed file extensions. - Only pass the path to read/write logic if it passes validation. 2. Identifier Validation: - should match a strict JavaScript identifier pattern. - should match the expected icon format. - Invalid values should be rejected before template interpolation. 3. Other Measures: - Remove all absolute paths from tool responses and replace out-of-bounds access errors with generic messages. - Finally, audit all code generation templates and all call sites using , , , or . POC Code Observations Step 1 (A): reads the path selected by the attacker. Step 2: writes a file controlled by the attacker to a path controlled by the attacker. Step 3: + injects raw JS/TS source code. Expected Results The server should reject values that resolve outside the project root directory. The server should restrict extensions to expected source/component types. should be validated as a JavaScript identifier before reaching any source/component templates. should be validated before being inserted into generated comments or framework templates. should not echo arbitrary absolute paths to the caller and should avoid differentiating out-of-bounds paths in the response text. Recommended Fixes Add a path safety wrapper for . Add identifier validation for component generation. Remove all absolute paths from tool responses and replace out-of-bounds access errors with generic messages. Audit all code generation templates and all call sites using , , , or .

Goal Reached Thanks to every supporter — we hit 100%!

better-icons MCP server allows out-of-scope file writes and source-code injection via sync_icon

More from this source