Context Mem MCP Server

In the server's implementation (`dashboard/server/api.js:135`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); const initProjectDir = currentProject || PROJECT_DIR; try {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dashboard/server/api.js

In the server's implementation (`dashboard/server/index.js:201`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnProc } = require('child_process'); const opener = process.platform === 'darwin' ? 'open' : process.platfor

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dashboard/server/index.js

In the server's implementation (`dist/cli/commands/dashboard.js:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: = dashboard; const node_child_process_1 = require("node:child_process"); const node_path_1 = __importDefault(require("no

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/commands/dashboard.js

In the server's implementation (`dist/cli/commands/plugin.js:37`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: in = plugin; const node_child_process_1 = require("node:child_process"); const fs = __importStar(require("node:fs")); co

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/commands/plugin.js

In the server's implementation (`dist/cli/commands/serve.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: /stdio.js"); const node_child_process_1 = require("node:child_process"); const node_path_1 = __importDefault(require("no

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/commands/serve.js

In the server's implementation (`dist/plugins/runtimes/sandbox.js:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: stAvailable; const node_child_process_1 = require("node:child_process"); // Environment variables that can be used for c

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/plugins/runtimes/sandbox.js

In the server's implementation (`dist/plugins/storage/better-sqlite3.js:81`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } } } exec(sql, params) { const db = this.getDb(); if (params && params.length > 0) {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/plugins/storage/better-sqlite3.js

In the server's implementation (`hooks/dashboard-autostart.js:18`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st { spawn } = require('child_process'); const path = require('path'); const fs = require('fs'); const os = require('os'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server hooks/dashboard-autostart.js

In the server's implementation (`hooks/dashboard-stop.js:55`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ') { require('child_process').execSync(`taskkill /PID ${pid} /F`, { stdio: 'ignore' }); } else {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server hooks/dashboard-stop.js

In the server's implementation (`hooks/session-start-hook.js:398`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); const updateScript = path.join(__dirname, '..', 'bin', 'update-check.js');

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server hooks/session-start-hook.js

In the server's implementation (`dist/core/providers/claude-provider.js:19`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch('https://api.anthropic.com/v1/messages', { method: 'POST',

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/providers/claude-provider.js

In the server's implementation (`hooks/dashboard-stop.js:55`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: equire('child_process').execSync(`taskkill /PID ${pid} /F`, { stdio: 'ignore' }); } else { process.kil

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server hooks/dashboard-stop.js

In the server's implementation (`hooks/session-start-hook.js:400`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const updateResult = execSync(`node "${updateScript}" 2>/dev/null`, { timeout: 2000, encoding: 'utf8', st

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server hooks/session-start-hook.js

In the server's implementation (`dashboard/server/index.js:95`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: th)) { Database = require(cmPath); } else { console.error('context-mem dashboard: better-sqlite3 not fou

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dashboard/server/index.js

In the server's implementation (`hooks/context-mem-precompact.js:18`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ths) { try { return require(p); } catch {} } return null; } const Database = loadBetterSqlite3(); if (!Database

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server hooks/context-mem-precompact.js

In the server's implementation (`hooks/proactive-inject.js:236`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ths) { try { return require(p); } catch {} } return null; } // --- Query extraction --- function extractQueryF

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server hooks/proactive-inject.js

In the server's implementation (`hooks/session-start-hook.js:45`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ths) { try { return require(p); } catch {} } return null; } // Resolve DB once for all functions const _dbPath

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server hooks/session-start-hook.js