bmad-mcp-server

A critical path traversal vulnerability exists in the `ReadResourceRequestSchema` handler and `ResourceLoaderGit.loadFile` function. If a malicious actor can control the `uri` parameter (e.g., `bmad:///etc/passwd` or `bmad://../../../../etc/passwd`), they can read arbitrary files on the system that the Node.js process has access to. The `path.join` function, when given an absolute path segment (like `/etc/passwd`) or enough `../` segments, can escape the intended `bmadRoot` directory. This allows unauthorized access to sensitive data. Additionally, while Git cloning to `~/.bmad/cache/git` limits impact, it still involves executing external `git` commands with URLs that could potentially be malicious, though `--depth 1` helps mitigate some deep repository risks.