AIKIDO-2025-10639

TL;DR

Affected versions of this package are vulnerable to Path Traversal due to improper input sanitization in the readMdxContent function. The vulnerability allows attackers to read arbitrary files by manipulating the docPath parameter to escape the intended directory (e.g., using ../../ sequences). This occurs because the joined path (fullPath) is not validated against the base directory before file system access, enabling unauthorized access to sensitive system files. An attacker could exploit this by crafting malicious paths to exfiltrate confidential data outside the docsBaseDir.