md-book

The MCP server and underlying services accept file system paths (e.g., `path` argument) directly from tool calls without explicit validation or sandboxing to restrict operations to a specific book's root directory. This creates a path traversal vulnerability where a malicious AI agent could potentially read, write, or modify arbitrary files on the host system that the `mdbook` process has permissions for. For example, by providing paths like `../../../etc/passwd` or `../../../.ssh/id_rsa`, an AI could exfiltrate sensitive system files or inject malicious content. The `release.py` script also uses `subprocess.run` with `shell=True`, which is generally discouraged, though this is for internal build processes, not core application functionality.