Path Traversal Arbitrary File Read Vulnerability in azer/react-analyzer-mcp

[gongyanyugyy]

Path Traversal Arbitrary File Read in azer/react-analyzer-mcp

Summary

I found a path traversal issue in azer/react-analyzer-mcp.

The MCP tool analyze-project accepts a caller-controlled projectName. In src/index.ts, that value is used directly in:

path.join(PROJECT_ROOT, subFolder)

to construct the scan root for the project. No normalization or containment check ensures that the resolved path remains inside PROJECT_ROOT.

The resulting path is then recursively traversed, and discovered .jsx / .tsx files are read using fs.readFileSync(filePath, "utf8").

Affected Version

• react-analyzer-mcp 0.1.0

Relevant Code Paths

• src/index.ts
  • listReactFiles(subFolder)
  • recursive scanDirectory(directory)
  • analyzeReactFileContents(filePath)
  • generateProjectDocs(projectName)
  • MCP tool handler for analyze-project

Impact

A malicious MCP client can escape the intended project root and cause the process to enumerate and read arbitrary React source files (.jsx / .tsx) from attacker-selected directories on the host.

Recommended Fix

• Treat projectName as an identifier, not a path fragment
• Reject traversal sequences and absolute paths
• Canonicalize the final resolved path and verify it stays under the configured project root before traversal starts

I have a local reproduction and will add it in a follow-up comment with output and screenshot.

[gongyanyugyy]

Reproduced locally on 2026-04-26 on Ubuntu 22.04 (WSL).

Minimal reproduction command:

wsl -d Ubuntu-22.04 bash -lc 'cd /mnt/c/Users/宫妍玉/Desktop/ts-batch-02/repos/azer-react-analyzer-mcp && node ./poc_projectname_traversal_read_linux.cjs'

This PoC mirrors the vulnerable logic in src/index.ts:

• path.join(PROJECT_ROOT, projectName)
• recursive directory traversal
• fs.readFileSync(filePath, "utf8") for .tsx / .jsx files

The injected project name is:

../../tmp/react-analyzer-mcp-path-traversal-arbitrary-file-read-poc

Observed result:

• the computed traversedFolderPath resolved outside the intended root
• the scanner found /tmp/react-analyzer-mcp-path-traversal-arbitrary-file-read-poc/SecretComponent.tsx
• the file content was read successfully
• the PoC output showed:
  • reactFiles containing the outside .tsx file
  • disclosureSucceeded: true
  • analysisPreview containing REACT_ANALYZER_MCP_PATH_TRAVERSAL_POC

Environment note:

• the repository hardcodes PROJECT_ROOT to /Users/azer/code, so I used a minimal local reproduction that mirrors the exact path-join, recursive traversal, and file-read logic from src/index.ts
• this was sufficient to confirm the arbitrary file read primitive without depending on the hardcoded host-specific path

I attached a screenshot showing the injected projectName, the resolved outside file path, and the disclosed file content marker.