The vulnerable code lies in JsonMemoryStorage functions (createDomain, getMemories, and saveMemories) within memory-graph’s memoryTools.ts. Input data for these functions is not properly sanitized, allowing a local attacker to craft a path that traverses directories. This flaw enables the attacker to read or write arbitrary files on the host, potentially compromising application data or executing destructive operations. The vulnerability matches CWE‑22, “Path Traversal.”

The issue impacts the open‑source Memory‑Graph project maintained by the user aaronsb. All revisions up to commit 5cfd2382778837b9f6399080956eee670d00452c contain the flaw. Because the project follows a rolling‑release model, no discrete version numbers for affected or patched releases are available, and no fix has yet been released.

The CVSS score of 4.8 indicates a moderate severity, and no EPSS score is available, suggesting limited public exploitation data. The vulnerability requires local access and is not listed in the CISA KEV catalog. The risk is significant primarily for systems where the application runs with elevated or uncontrolled privileges, or where the executable has write permissions to its own directory.