{"action":"Upgrade mcp-memory-keeper to 0.13.0 or later.","affected":[{"fixed":"0.13.0","introduced":"0"}],"component":"mcp-memory-keeper","cve_ids":["CVE-2026-54561"],"ecosystem":"npm","epss":0.00249,"exploited":false,"fixed_versions":["0.13.0"],"ghsa_id":"GHSA-f7wf-v2vw-mpcx","id":"tcs_01M5KFMXNPWWTJVB5RA3SPZ6PQ","modified_at":"2026-07-31T05:15:33.861007462Z","published_at":"2026-07-17T19:23:07Z","references":["https://osv.dev/vulnerability/GHSA-f7wf-v2vw-mpcx","https://github.com/mkreyman/mcp-memory-keeper/security/advisories/GHSA-f7wf-v2vw-mpcx","https://github.com/mkreyman/mcp-memory-keeper/issues/35","https://github.com/mkreyman/mcp-memory-keeper/pull/36","https://github.com/mkreyman/mcp-memory-keeper/commit/84f6dfa692736a34ff36e2d2cf2188b71facf73b","https://github.com/mkreyman/mcp-memory-keeper","https://github.com/mkreyman/mcp-memory-keeper/releases/tag/v0.13.0"],"severity":{"label":"medium","score":6.2},"sources":[{"source":"osv","source_id":"GHSA-f7wf-v2vw-mpcx","url":"https://osv.dev/vulnerability/GHSA-f7wf-v2vw-mpcx"}],"summary":"mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath"}