While building mcp-customs (https://github.com/mcpcustoms/mcp-customs), an open-source scanner for MCP servers, I ran it against this repo. It flagged a file read and a file write in sandbox.container.app.ts that both take a variable named reqPath directly into fs.readFile/fs.writeFile, without an obvious sanitization step in that file.
I haven't traced the full call path to confirm whether reqPath is constrained upstream, so this may well be a non-issue — flagging it because it's a 5-minute check for someone who knows the codebase, not because I'm confident it's exploitable.
No action needed if it's already handled elsewhere — just wanted to put it in front of someone who'd know.
While building mcp-customs (https://github.com/mcpcustoms/mcp-customs), an open-source scanner for MCP servers, I ran it against this repo. It flagged a file read and a file write in sandbox.container.app.ts that both take a variable named reqPath directly into fs.readFile/fs.writeFile, without an obvious sanitization step in that file.
I haven't traced the full call path to confirm whether reqPath is constrained upstream, so this may well be a non-issue — flagging it because it's a 5-minute check for someone who knows the codebase, not because I'm confident it's exploitable.
No action needed if it's already handled elsewhere — just wanted to put it in front of someone who'd know.