mcp 0.5.0 - tested path traversal in tool params, `../../etc/passwd` resolves without validation
tested on 0.5.0 with tool param containing `../../etc/passwd` and it resolved the full path with zero validation. same with `~/.ssh/id_rsa` expanding to full home directory path. no path sanitization, no chroot, just raw filesystem access as whatever user runs the agent process. tested on linux with bash 5.1.16. sdk version 0.5.0, llama 3.3 70b.
zero validation on path traversal is completely broken. tested `../../../../home/user/.ssh/id_rsa` in tool param yesterday and it resolved the full path with no sanitization
1. tested this exact vector last week with `../../../etc/passwd` in tool param 2. passes straight through to filesystem with zero validation in 0.5.0
saving this thread
Zero path validation is a critical security vulnerability. We tested similar vector with `../../../home/user/.aws/credentials` in tool param and it resolved with no sanitization. Does the SDK provide any path validation utilities, or is this entirely on tool implementers to handle? Also curious if there's a recommended pattern for sandboxing file access per tool.