CVE-2026-88938 in Knowns
Summary
by MITRE • 09/10/2026
knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full file contents from outside the intended project directory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability described constitutes a critical Path Traversal flaw within the code.find MCP tool, specifically affecting versions up through 0.33.0. This security deficiency arises from an insufficient validation of user-supplied input for the path argument, which is designed to locate and retrieve source files within a project directory. In secure software design, functions that access file systems must strictly enforce boundary constraints to ensure that operations remain confined to authorized directories. However, in this implementation, the application fails to adequately sanitize or normalize the provided path string before processing it for file system access. This oversight allows an attacker to manipulate the input using absolute paths or relative traversal sequences such as dot-dot-slash patterns to escape the intended project root directory and access arbitrary files on the host operating system.
From a technical perspective, this flaw aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core issue lies in the lack of canonicalization or strict path validation logic within the MCP tool's handler. When an AI agent session interacts with the code.find tool, it can construct malicious requests that bypass directory restrictions. For instance, by supplying a relative path containing traversal sequences, the underlying file system operations resolve these paths to locations outside the sandboxed project environment. Similarly, providing absolute paths allows direct access to sensitive areas of the filesystem such as configuration files, credential stores, or other application codebases residing on the same host machine. This behavior effectively nullifies any intended isolation mechanisms provided by the MCP framework for AI agent sessions.
The operational impact of this vulnerability is severe due to its potential for unauthorized data exfiltration and information disclosure. Since AI agents often operate with elevated privileges or broad access scopes within development environments, an attacker leveraging this flaw can read sensitive source code, proprietary algorithms, internal documentation, and potentially confidential configuration files that contain API keys, database credentials, or other secrets. This exposure compromises the confidentiality integrity of the entire system infrastructure. Furthermore, if the MCP tool is integrated into a larger automated pipeline where AI agents make decisions based on file contents, this vulnerability could serve as an initial foothold for more complex attacks, including logic manipulation or supply chain compromise by altering external dependencies read from outside the project root.
This incident maps directly to several entries in the MITRE ATT&CK framework, particularly T1083: File and Directory Discovery, which describes techniques used to enumerate files and directories on a target system. Additionally, it relates to T1530: Data from Local System, as the attacker retrieves data stored locally on the host machine outside of authorized boundaries. The vulnerability also reflects weaknesses in input validation practices often categorized under CWE-20: Improper Input Validation, highlighting the necessity for rigorous sanitization protocols when handling file system paths in any application exposed to untrusted inputs.
To mitigate this risk, immediate remediation is required by updating the code.find MCP tool to a version greater than 0.33.0 where these path confinement issues have been addressed. In versions prior to the fix, developers should implement strict input validation that rejects absolute paths and normalizes relative paths to ensure they remain within the designated project root directory. This can be achieved by resolving both the base project directory and the user-supplied path to their canonical forms and verifying that the resolved target path starts with the expected prefix representing the project root. Additionally, employing allowlists for permitted file extensions or directories can further restrict access scope. Security teams should also audit other MCP tools within the ecosystem for similar input handling deficiencies to prevent broader exploitation across AI agent workflows.