The initProjectMemory function in the Per-Project Auto-Memory Handler of DeepMyst Mysti can be abused by manipulating its workspacePath argument to reveal internal resources that should remain hidden, allowing an attacker to disclose sensitive information and exposing the system to information disclosure (CWE-200). Because the function does not enforce proper input validation or access checks, a remote attacker can exploit the component if it is reachable over the network, resulting in unauthorized resource exposure. The likely attack vector involves supplying a crafted workspacePath to a publicly accessible handler of the Per-Project Auto-Memory Module.

DeepMyst Mysti versions older than 0.4.0 are affected; all releases up to 0.3.x come with this flaw. The fix is implemented in commit 6d709229b5199f6769fb3cf763e5122dcc43c079 and is available in version 0.4.0.

The CVSS base score is 5.3, indicating a moderate risk, while the EPSS score is less than 1%, reflecting a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the Per-Project Auto-Memory Handler to be exposed over a network; a remote attacker can then trigger the resource disclosure without prior authentication or local access.