The vulnerability in angrysky56 advanced-reasoning-mcp 1.0.0 involves path traversal caused by improper handling in the create_system_json, create_library, get_system_json, and switch_memory_library functions within src/index.ts. This allows an attacker with local access to manipulate file paths to access files outside the intended directory. The issue was reported early but remains unpatched and unaddressed by the vendor.

An attacker with local access can exploit this vulnerability to perform path traversal, potentially reading or manipulating files outside the intended scope of the application. This could lead to unauthorized information disclosure or modification of files accessible to the application user context. There is no indication of remote exploitation or privilege escalation beyond local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for any suspicious activity related to file access. Avoid running the vulnerable version in untrusted environments until a fix is available.