GHSA-xh92-rqrq-227v: 
JavaScript vulnerability analysis and mitigation

The @mastra/mcp-docs-server package, versions 0.13.18 and below, contains a Directory Traversal vulnerability that leads to information exposure. This server, designed to provide documentation context to AI agentic workflows, is susceptible to an attack that allows unauthorized directory listing disclosure. The vulnerability was discovered and reported by Liran Tal, published on September 24, 2025, and has been assigned the identifier GHSA-xh92-rqrq-227v with a moderate severity rating (CVSS score: 6.5) (GitHub Advisory).

The vulnerability stems from a logical flaw in the code where the security check in the readMdxContent function can be bypassed. While the function correctly checks for path traversal attempts when reading file contents, the main execute function continues to process the path even after a security violation is detected. This occurs because the code proceeds to call findNearestDirectory(path, availablePaths) without proper path validation, allowing un-sanitized paths to be used for directory listing. The vulnerability is tracked as CWE-548 (Exposure of Information Through Directory Listing) and has been assigned a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) (GitHub Advisory).

The vulnerability exposes sensitive information about the user's file system structure. When exploited, it can reveal the presence of sensitive tools (.BurpSuite), configuration files (.config), cloud credentials (.aws/, .gcp/), and private project directories. This information disclosure could be leveraged by attackers to plan and execute more targeted attacks (GitHub Advisory).

The vulnerability has been patched in version 0.17.0. The recommended fixes include halting execution immediately when a path traversal attempt is detected and implementing defense-in-depth by applying path validation logic to the findNearestDirectory function. Users should upgrade to the patched version to prevent unauthorized directory listing exposure (GitHub Advisory, Mastra Commit).