DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resource
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of the file src/managers/MemoryManager.ts of the component Per-Project Auto-Memory Handler. Such manipulation of the argument workspacePath leads to exposure of resource. The attack may be performed from remote. Upgrading to version 0.4.0 is sufficient to fix this issue. The name of the patch is 6d709229b5199f6769fb3cf763e5122dcc43c079. It is advisable to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Mysti (DeepMyst) Fixed in 0.4.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-14611
- 2026-10-03 Alias added: GHSA-fwpr-59hh-gr98
References
More DeepMyst vulnerabilities
- TI-2026-11514 DeepMyst Mysti Contact Tracking ChannelBridge.ts _isTrackedConversation improper authorization CVSS 4.0LOW 2.3
Sources
- CVE-2026-14611 · CVE Program
- CVE-2026-14611 · NVD
- FIRST EPSS
- GHSA-fwpr-59hh-gr98 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences