A path traversal vulnerability in the claude-sesh tool , which helps developers search for and resume old Claude Code sessions, allows a local malicious client to read or write files outside of the intended folder. The issue is documented as the claude-sesh tool and has already been fixed in the main branch of the project.
claude-sesh is an open source session exploration tool for Claude Code. It reads local history files, displays conversations, searches, and usage statistics, and provides an MCP so that an assistant can retrieve information from previous tasks.
See also: NanoClaw: serious file leakage vulnerability
How the claude-sesh tool works
The vulnerability is located in the src/services/enricher.ts file , in the getEnrichedData and enrichSession functions. The sessionId value was coming from MCP calls or web calls and was passed directly to path creation with path.join . This allowed specially crafted sequences to escape the storage folder.
In practice, this tool does not require remote access per se. The attacker must be able to run or call the corresponding client locally, but this does not reduce the risk on shared workstations, development environments, or automations where the MCP server runs with user privileges.
According to the GitHub issue report, the same value could be used to both read and write JSON files outside the ~/.claude-sesh/enriched. The report describes successful local replication on Windows, accessing a file that was outside the expected range.
What does the claude-sesh tool fix?
The report originally referred to version 1.1.3, while the CVE-2026-19327 refers to version 1.0.0. The available information does not give a clear safe version number, so administrators should check the source and installation date of their package, rather than relying on a version number alone.
The fix is in commit 786c9d7. The code now only accepts session IDs with letters, numbers, underscores, and hyphens. It also resolves the final path and verifies that it remains within the rich data folder before any read or write.
This double filter is essential because checking for just the ../ does not cover all path variations or differences between operating systems. The issue is properly addressed when the application checks both the input and the final, normalized path.
See also: Windmill: path traversal vulnerability with serious consequences
Protection measures for the claude-sesh tool
Users who installed claude-sesh from npm or a clone of the repository should apply the available fix and restart the MCP server. In development environments, the update should be accompanied by a lock file check and a fresh installation to avoid leaving old code in a temporary directory.
Because claude-sesh processes session history and optionally stores rich data, it is worth checking the folders for files that were created or modified unexpectedly. The check should be done with the permissions of the application user and without executing any unknown files found during the search.
The incident shows why local development services should not be automatically considered harmless. An MCP server can accept data from tools, extensions or automations and access files containing job history. The SecNews technical team recommends limited permissions, server isolation and call logging.
See also: SiYuan: vulnerability exposes MCP tools and workspace
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The entry for the claude-sesh tool has a CVSS score of 5.3, which is medium severity, and states that the exploit requires local access. However, the claude-sesh tool targets data that often contains code, credentials, or internal decisions. Installing the patch and verifying the storage path are key steps for safe use.
