Exposure of Resource in DeepMyst Mysti (CVE-2026-14611)
CVE-2026-14611 is a vulnerability in DeepMyst Mysti affecting versions up to 0.4.0. It involves the initProjectMemory function in the Per-Project Auto-Memory Handler component, where manipulation of the workspacePath argument can lead to exposure of resources. The vulnerability can be exploited remotely. Upgrading to version 0.4.0 addresses this issue.
AI Analysis
Technical Summary
This vulnerability in DeepMyst Mysti (up to version 0.4.0) is caused by improper handling of the workspacePath argument in the initProjectMemory function within src/managers/MemoryManager.ts. This flaw allows an attacker to cause exposure of resources, potentially leaking sensitive information. The vulnerability is remotely exploitable and is classified under CWE-668 (Exposure of Resource to Wrong Sphere) and CWE-200 (Information Exposure). The issue is fixed by upgrading to version 0.4.0, with the patch identified by commit 6d709229b5199f6769fb3cf763e5122dcc43c079.
Potential Impact
The vulnerability allows remote attackers to expose resources due to improper argument handling, which may lead to unauthorized information disclosure. The CVSS 4.0 base score is 5.3 (medium severity), indicating a moderate impact with network attack vector, low complexity, and no privileges or user interaction required.
Mitigation Recommendations
Upgrade DeepMyst Mysti to version 0.4.0 or later, as this version includes the official fix for the vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Exposure of Resource in DeepMyst Mysti (CVE-2026-14611)
Description
CVE-2026-14611 is a vulnerability in DeepMyst Mysti affecting versions up to 0.4.0. It involves the initProjectMemory function in the Per-Project Auto-Memory Handler component, where manipulation of the workspacePath argument can lead to exposure of resources. The vulnerability can be exploited remotely. Upgrading to version 0.4.0 addresses this issue.
CVSS v4.0
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in DeepMyst Mysti (up to version 0.4.0) is caused by improper handling of the workspacePath argument in the initProjectMemory function within src/managers/MemoryManager.ts. This flaw allows an attacker to cause exposure of resources, potentially leaking sensitive information. The vulnerability is remotely exploitable and is classified under CWE-668 (Exposure of Resource to Wrong Sphere) and CWE-200 (Information Exposure). The issue is fixed by upgrading to version 0.4.0, with the patch identified by commit 6d709229b5199f6769fb3cf763e5122dcc43c079.
Potential Impact
The vulnerability allows remote attackers to expose resources due to improper argument handling, which may lead to unauthorized information disclosure. The CVSS 4.0 base score is 5.3 (medium severity), indicating a moderate impact with network attack vector, low complexity, and no privileges or user interaction required.
Mitigation Recommendations
Upgrade DeepMyst Mysti to version 0.4.0 or later, as this version includes the official fix for the vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fwpr-59hh-gr98
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-14611"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a483c9827e9c79719d7ec7a
Added to database: 07/03/2026, 22:50:00 UTC
Last enriched: 07/11/2026, 07:53:54 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 99
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.