CVE-2025-61685 (CNNVD-202510-388)
中文标题:
Mastra 安全漏洞
英文标题:
Mastra Docs MCP Server `@mastra/mcp-docs-server` Leads to Information Exposure
漏洞描述
中文描述:
Mastra是mastra-ai开源的一个AI代理框架。 Mastra 0.13.8版本至0.13.20-alpha.0版本存在安全漏洞，该漏洞源于安全检查被绕过，可能导致目录遍历攻击。
英文描述:
Mastra is a Typescript framework for building AI agents and assistants. Versions 0.13.8 through 0.13.20-alpha.0 are vulnerable to a Directory Traversal attack that results in the disclosure of directory listings. The code contains a security check to prevent path traversal for reading file contents, but this check is effectively bypassed by subsequent logic that attempts to find directory suggestions. An attacker can leverage this flaw to list the contents of arbitrary directories on the user's filesystem, including the user's home directory, exposing sensitive information about the file system's structure. This issue is fixed in version 0.13.20.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| mastra-ai | mastra | <= 0.13.8, < 0.13.20 | - | - |
cpe:2.3:a:mastra-ai:mastra:<=_0.13.8,_<_0.13.20:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-61685 |
2025-11-11 15:23:33 | 2025-11-11 07:40:48 |
| NVD | nvd_CVE-2025-61685 |
2025-11-11 15:01:04 | 2025-11-11 07:48:35 |
| CNNVD | cnnvd_CNNVD-202510-388 |
2025-11-11 15:12:30 | 2025-11-11 08:00:20 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202510-388
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']