Security Advisory

Claude-Mem: Unauthenticated
Local Memory API Exposure

Comprehensive Code Review of thedotmack/claude-mem

GitHub Issue #1251 · Opened Feb 26, 2026 by CheswickDEV · Rated HIGH risk

ESL Analysis & Patch · April 2026

What is claude-mem?

A third-party persistent memory plugin for Claude Code that captures, compresses, and reinjects session context across coding sessions.

History & Timeline

Audit Findings Overview

From Issue #1251 — 17 findings across Critical, Medium, and Low severity

What's Been Fixed So Far

While these mitigations are welcome, the most critical findings from the audit remain open ↓

What's Still Open

C-1 Deep Dive: Path Traversal

Both smart_unfold and smart_outline resolve the path but never check boundaries:

// src/servers/mcp-server.ts — VULNERABLE CODE

handler: async (args) => {
  const filePath = resolve(args.file_path);       // ← normalizes, does NOT restrict
  const content = await readFile(filePath, 'utf-8'); // ← reads ANY file on disk
  const unfolded = unfoldSymbol(content, filePath, args.symbol_name);
  // ...
}

Meanwhile, CorpusStore in the same project does it correctly:

// CorpusStore.getFilePath() — PROPERLY GUARDED

private getFilePath(name: string): string {
  const safeName = this.validateCorpusName(name);    // ← regex allowlist
  const resolved = path.resolve(this.corporaDir, safeName);
  if (!resolved.startsWith(path.resolve(this.corporaDir) + path.sep)) {
    throw new Error('Invalid corpus name');           // ← containment check
  }
  return resolved;
}

Risk Scenarios

DataCamp (Mar 30, 2026): "claude-mem should be treated as unsafe on shared machines, cloud VMs, or environments with secrets."

ESL Security Patch

Engineering Software Lab — creator of AI security tools — has developed and published a local patch that mitigates the path traversal vulnerability (C-1).

// ESL Patch: Path containment guard injected before readFile()

handler: async (args) => {
  const filePath = resolve(args.file_path);
+ const cwd = resolve(process.cwd());
+ if (!filePath.startsWith(cwd + sep) && filePath !== cwd) {
+   throw new Error("Path traversal blocked: " + filePath + " is outside " + cwd);
+ }
  const content = await readFile(filePath, 'utf-8');
  // ... rest of handler unchanged
}

Applied to both smart_unfold and smart_outline handlers in the compiled mcp-server.cjs

How to Apply the Fix

git clone https://github.com/
  zuwasi/claude-mem-security-fix

cd claude-mem-security-fix

.\apply_patch.ps1

git clone https://github.com/
  zuwasi/claude-mem-security-fix

cd claude-mem-security-fix

chmod +x apply_patch.sh
./apply_patch.sh

Verify the Patch

# PowerShell — should return 2 matches
Select-String "Path traversal blocked" `
  "$env:APPDATA\npm\node_modules\claude-mem\plugin\scripts\mcp-server.cjs"

# Expected output:
mcp-server.cjs:217: ... Path traversal blocked ...  (smart_unfold)
mcp-server.cjs:221: ... Path traversal blocked ...  (smart_outline)

Recommendations

Engineering Software Lab

Creator of AI security tools — protecting teams from emerging AI supply-chain threats

Original audit: CheswickDEV · Issue #1251 · Feb 26, 2026
ESL patch & advisory: April 2026