Memory Service MCP Server

In the server's implementation (`claude-hooks/core/topic-change.js:159`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const resultsArray = eval(resultsMatch[1]); return resultsArray || []; } }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/core/topic-change.js

In the server's implementation (`claude-hooks/utilities/dynamic-context-updater.js:381`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: return eval(resultsMatch[1]) || []; } } return []; } ca

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/utilities/dynamic-context-updater.js

The implementation both builds shell commands out of runtime values (`claude-hooks/utilities/git-analyzer.js`) and evaluates runtime values as code (`claude-hooks/core/topic-change.js`). Each is a separate arbitrary-execution primitive; a server exposing both gives anything that reaches either one a direct path to running attacker-chosen code. These two sinks are in different files — confirm whether they are actually connected, or are unrelated code paths (e.g. a vendored bundle plus a CLI wrapper).

Fix: Remove the dynamic eval, and pass command arguments as an argv array instead of building a shell string. If both are genuinely required, constrain and validate every value that can reach them.

Location: server implementation

In the server's implementation (`claude-hooks/core/topic-change.js:159`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const resultsArray = eval(resultsMatch[1]); return resultsArray || []; } }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/core/topic-change.js

In the server's implementation (`claude-hooks/utilities/dynamic-context-updater.js:381`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: return eval(resultsMatch[1]) || []; } } return []; } ca

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/utilities/dynamic-context-updater.js

In the server's implementation (`claude-hooks/core/session-start.js:326`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } = require('child_process'); // Sanitize inputs to prevent injection via project names or queries

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/core/session-start.js

In the server's implementation (`claude-hooks/install_hooks.py:122`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y: result = subprocess.run(['claude', '--help'], capture_output=True, text

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/install_hooks.py

In the server's implementation (`claude-hooks/utilities/git-analyzer.js:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); /** * Get recent commit history with detailed information */ async function

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/utilities/git-analyzer.js

In the server's implementation (`claude-hooks/utilities/mcp-client.js:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st { spawn } = require('child_process'); const { EventEmitter } = require('events'); const fs = require('fs'); const pat

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/utilities/mcp-client.js

In the server's implementation (`claude-hooks/utilities/project-detector.js:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); /** * Detect programming language from file extensions */ async function det

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/utilities/project-detector.js

In the server's implementation (`claude-hooks/utilities/git-analyzer.js:59`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const filesOutput = execSync(`git show --name-only --pretty="" ${commit.fullHash}`, { cwd: path.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/utilities/git-analyzer.js

In the server's implementation (`src/mcp_memory_service/dependency_check.py:102`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: __import__(package.replace("-", "_")) logger.debug(f"{_sanitize_log_value(package)}

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp_memory_service/dependency_check.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/maintenance/update_graph_relationship_types.py:141`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: tags = eval(row["tags"]) except: tags = [] mem

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/maintenance/update_graph_relationship_types.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/run_memory_server.py:36`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ='utf-8') as f: exec(compile(f.read(), new_script, 'exec'), global_vars) else: print(f"[ERROR] Could not fin

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/run_memory_server.py

In a packaging/dev/install script (shipped, but not the server runtime) (`site/demo/assets/transformers.min.js:12`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , args) { ${z} }`,h=new Function(Object.keys(P),z)(...Object.values(P)),z=`methodCaller<(${E.map(j=>j.name)}) => ${g

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server site/demo/assets/transformers.min.js

In a packaging/dev/install script (shipped, but not the server runtime) (`claude-hooks/scripts/ensure-server.js:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st { spawn } = require('child_process'); const HEALTH_TIMEOUT_MS = 500; const POLL_INTERVAL_MS = 500; const POLL_TIMEOU

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/scripts/ensure-server.js

In a packaging/dev/install script (shipped, but not the server runtime) (`claude-hooks/tests/ensure-server.test.js:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st { spawn } = require('child_process'); const SCRIPT = path.join(__dirname, '..', 'scripts', 'ensure-server.js'); fun

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/tests/ensure-server.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`claude-hooks/tests/integration-test.js:477`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 'fs', 'path', 'https', 'child_process']; for (const module of requiredModules) { try {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/tests/integration-test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`claude-hooks/tests/test-code-execution.js:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); // ANSI Colors const COLORS = { RESET: '\x1b[0m', GREEN: '\x1b[32m',

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/tests/test-code-execution.js

In a packaging/dev/install script (shipped, but not the server runtime) (`claude-hooks/tests/test-permission-request.js:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); // ANSI Colors const COLORS = { RESET: '\x1b[0m', GREEN: '\x1b[32m',

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/tests/test-permission-request.js

In a packaging/dev/install script (shipped, but not the server runtime) (`claude-hooks/tests/integration-test.js:481`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { require(module); } catch (error) { return { success: false, error: `

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server claude-hooks/tests/integration-test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/service/service_utils.py:128`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: __import__(module) except ImportError: missing.append(module)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/service/service_utils.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/utils/smithery_wrapper.py:50`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: __import__(package) print_info(f"✓ {package} is available") except ImportErr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/utils/smithery_wrapper.py

In a packaging/dev/install script (shipped, but not the server runtime) (`site/demo/assets/transformers.min.js:12`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: (e)},TA=async t=>(await import(t)).default,Zf=($z(),Tc(f2)).default,g2=async()=>{if(!zt)throw new Error("Failed to load

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server site/demo/assets/transformers.min.js