profile-memory-mcp-server

CRITICAL SQL INJECTION: The `update_profile` endpoint dynamically constructs the SQL `SET` clause by interpolating field keys (`${key}`) directly from `req.body.fields` into the SQL string. This allows for SQL injection if a malicious user provides crafted keys in the `fields` object, potentially leading to unauthorized data manipulation or deletion. INFORMATION LEAKAGE: Error messages expose internal server details, which could aid attackers. The default CORS origin `*` is broad and should be tightened in production deployments to specific origins to prevent unintended cross-origin access, though it might be intended for internal use as an MCP server.