Tag
isolation
10 entries, including 1 pattern.
A checkpoint is not inert data
Loading a pickle-based model file runs whatever the file tells the unpickler to run. Attackers have shipped reverse shells on Hugging Face that fire on load, and one campaign broke its own file so the scanner errored after the payload had already executed.
- Pattern
Enforced Filesystem Scope for MCP Servers
Treat selected directories as intent and constrain the server process to the files it may actually open.
The folder picker did not confine the server
MCP roots describe where a server should work; they do not restrict what its process can read.
Inspected is not executed
A safety check on the raw command or code string does not prove the runtime will execute that same string.
Allowlisted is not constrained
Matching the first path token against an allowlist does not prove the process will only run that program's intended verbs.
Denied on the sandbox is not denied on the loopback
A sandbox tools.deny entry is not a gate if the MCP loopback never applies it.
A browsing agent inherits localhost
An Origin allowlist for 127.0.0.1 does not stop JavaScript that a local agent just rendered.
Validated is not pinned
A hostname that passed an SSRF check can still dial a different address on the next lookup.
URL validation is not egress
A deny-list in the fetch helper is not a network policy. The agent host still reaches what the process can reach.
An isolate is not a host boundary
A V8 isolate or a NodeVM box can still leave the host process writable.