If you use a tool called notes-mcp to connect your AI assistant to your personal notes, a stranger on the internet may already be able to read any file on your computer — not just your notes.
Who's Affected and Why It Matters
notes-mcp is an open-source connector built for the Model Context Protocol (MCP) ecosystem — the rapidly growing layer of software that lets AI assistants like Claude directly read, write, and manage files on your local machine. Developers, writers, and power users have adopted tools like these to give their AI assistants real memory and real access to local data. That's exactly what makes this vulnerability serious.
Every user running notes-mcp version 0.1.4 or earlier — the entire released history of the project — is potentially exposed. Because MCP connectors are typically running locally but can accept remotely triggered instructions through the AI model, an attacker doesn't need to be sitting at your keyboard. They just need a path in.
What the Attacker Can Actually Do
Imagine you hired a filing assistant and told them, "You're only allowed to work inside this one cabinet." Now imagine that assistant will follow instructions from anyone who shouts through your window — and those instructions can include, "Actually, go into every other room in the house." That's essentially what this vulnerability enables.
notes-mcp is supposed to confine itself to a specific folder you designate — your notes directory. But because the software doesn't properly check whether a file path stays inside that designated folder, an attacker can craft a request using a classic trick: feeding it a path like ../../etc/passwd or ../../Users/you/Documents/taxes.pdf. Those two dots tell the system "go up one level" — and by stringing them together, an attacker climbs right out of the notes folder and into the rest of your filesystem. Any file your user account can read, the attacker can potentially read too.
Because MCP tools are designed to be triggered remotely through AI model interactions, this attack doesn't require physical access to your machine. An attacker could, in theory, craft a malicious prompt or instruction that travels through the AI layer and lands on your local system with file-reading consequences you never intended to authorize.
The Technical Detail Security Teams Need to Know
The vulnerability is a path traversal flaw (CWE-22) located in the notes_mcp.py file, specifically in the handling of the root_dir and path arguments. There is no sanitization or canonical path validation to confirm that a resolved file path remains within the intended base directory. The flaw carries a CVSS score of 7.3 (HIGH), reflecting its remote exploitability and low attack complexity — meaning no special privileges or user interaction are required beyond getting a crafted path into the tool's input.
Real-World Context: Disclosed Publicly, Maintainer Silent
The vulnerability was discovered and responsibly reported to the project maintainer, edvardlindelof, via a GitHub issue before public disclosure — a textbook example of coordinated disclosure. However, as of the time of this writing, the maintainer has not responded and no patch has been released. The exploit details are now publicly available, meaning any motivated attacker can read the disclosure and begin probing systems running the vulnerable versions.
No active exploitation campaigns have been confirmed yet. But the combination of a public exploit, a silent maintainer, and a growing MCP user base creates a window of real risk. The MCP ecosystem is new enough that many users may not have mature patching habits around these tools — making awareness especially urgent right now.
What You Should Do Right Now
- Uninstall or disable notes-mcp immediately if you are running version 0.1.4 or earlier. Since no patched version currently exists, the safest action is to stop using the tool entirely until a fix is confirmed. Remove it from your MCP configuration and restart any connected AI assistant services.
-
Audit what your MCP tools can access. Open your MCP configuration file (often found at
~/.config/mcp/config.jsonor equivalent) and review every tool listed. Remove any connector you don't actively need. Principle of least privilege applies here: if a tool doesn't need access to a folder, don't give it access. - Watch the repository for a patched release and subscribe to its security alerts. Visit github.com/edvardlindelof/notes-mcp, click Watch → Custom → Security alerts, and do not reinstall until a version higher than 0.1.4 appears with explicit mention of path traversal fixes in the release notes.
CVE: CVE-2026-7212 | CVSS: 7.3 HIGH | Affected versions: notes-mcp ≤ 0.1.4 | Patch available: No | Active exploitation: Not confirmed