tigerless-labs/agent-memory

This critical vulnerability in the `import_into` function allows directory traversal, enabling an attacker to write arbitrary files outside the intended store root. By exploiting `pathlib.Path`'s `..` traversal, a malicious export file can compromise the host system. This is a severe security flaw, as `mem import` is a documented migration path, implying trust in imported data. The ability to write files anywhere the process has permissions represents a direct path to system compromise. For a B2B SaaS product, such a vulnerability is unacceptable, leading to significant security risks, potential data breaches, and severe reputational damage. Immediate remediation is required to validate target paths against the store root, a fundamental security practice.