CVE-2026-55156: 
JavaScript vulnerability analysis and mitigation

CVE-2026-55156 is an unauthenticated path traversal vulnerability in the dashboard HTTP server of the @ooples/token-optimizer-mcp npm package. The flaw affects version 5.0.1 (commit 8137147) and was first published on June 10, 2026, with the advisory added to the GitHub Advisory Database on August 14, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and is tracked under GHSA-76pc-mqxp-3rq5. The patched version is 5.1.0, released July 20, 2026 (GitHub Advisory, Security Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In src/server/web-server.ts, both the /api/session-summary (lines 73–88) and /api/session-events (lines 297–311) endpoints accept a sessionId query parameter and concatenate it unsanitized into a filesystem path using path.join(hooksDataPath, \session-log-${sessionId}.jsonl`). Node.js normalizes ..segments at resolution time, so a craftedsessionIdsuch asabc%2F..%2F..%2F..%2F..%2Ftargettraverses outside the intendedhooksDataPath` directory. Neither endpoint has authentication middleware, meaning any network-accessible client can trigger the read with a single unauthenticated HTTP GET request (GitHub Advisory, Security Advisory).

A successful exploit allows an unauthenticated remote attacker to read the contents of any .jsonl file accessible to the process running the dashboard server. This includes all session log files — which may contain tool invocations, hook outputs, and token usage data — as well as any other .jsonl file reachable via directory traversal from hooksDataPath. The attack surface is constrained to files with the .jsonl extension, limiting but not eliminating the risk of sensitive data exposure. There is no integrity or availability impact; the vulnerability is purely a confidentiality concern (GitHub Advisory).

A working proof-of-concept is publicly documented in the GitHub Security Advisory, requiring only a single unauthenticated HTTP GET request with a URL-encoded traversal payload. No privileges, user interaction, or special network position are required. There is no current evidence of in-the-wild exploitation, no known threat actor attribution, and the CVE status remains "Reserved." CISA KEV catalog inclusion has not been reported (GitHub Advisory, Security Advisory).

1. Reconnaissance: Identify hosts running token-optimizer-mcp version 5.0.1 with the dashboard HTTP server exposed on port 3100 (default). This can be done via network scanning tools such as nmap or internet-wide scanners like Shodan.
2. Confirm endpoint availability: Send a baseline GET request to http://<target>:3100/api/session-events?sessionId=test to confirm the server is running and the endpoint responds.
3. Craft traversal payload: Construct a sessionId value containing URL-encoded path traversal sequences, e.g., abc%2F..%2F..%2F..%2F..%2Ftarget-filename (where target-filename is the base name of the target .jsonl file without extension).
4. Send unauthenticated request: Execute the traversal request with no credentials:

curl -s "http://<target>:3100/api/session-events?sessionId=abc%2F..%2F..%2F..%2F..%2Ftraversal-target"

5. Retrieve file contents: If the target .jsonl file exists and is readable by the server process, the server returns HTTP 200 with the file's JSON Lines content in the response body, confirming successful out-of-bounds file read (GitHub Advisory, Security Advisory).

• Network: Inbound HTTP GET requests to port 3100 targeting /api/session-events or /api/session-summary with sessionId query parameters containing URL-encoded path separators (%2F) or dot sequences (%2E%2E, ..).
• Logs: Express access logs showing requests such as GET /api/session-events?sessionId=abc%2F..%2F..%2F..%2F..%2F<filename> returning HTTP 200 with non-empty response bodies; any sessionId value that does not match ^[A-Za-z0-9_-]{1,64}$.
• File System: Unexpected reads of .jsonl files located outside the ~/.claude-global/hooks/data/ directory by the Node.js process running the dashboard server (observable via file access auditing tools such as auditd on Linux).
• Process: The node process serving the dashboard making fs.readFileSync calls to paths outside the expected hooksDataPath directory (GitHub Advisory).

Upgrade @ooples/token-optimizer-mcp to version 5.1.0 or later, which validates sessionId against the strict regex ^[A-Za-z0-9_-]{1,64}$ on both affected endpoints and adds a secondary containment check using path.resolve + path.relative to ensure the resolved path stays within hooksDataPath. The fix also adds express-rate-limit (300 req/min) to all dashboard routes as defense-in-depth. If immediate upgrade is not possible, restrict network access to port 3100 to trusted hosts only, or disable the dashboard server entirely (GitHub Advisory, v5.1.0 Release, Fix Commit).