Invalid mount path: ${mountPath}. Path segments cannot be ".

Error message

Invalid mount path: ${mountPath}. Path segments cannot be "." or "..".

What it means

validateMountPath rejects any path segment equal to `.` or `..`. Dot-dot segments could escape the intended mount namespace (path traversal), and `.` segments are ambiguous. Paths must be canonical — no relative traversal inside the mount point.

Source

Thrown at packages/core/src/workspace/sandbox/local-sandbox.ts:72

export function getMarkerDir(): string {
  return path.join(os.tmpdir(), '.mastra-mounts');
}

/** Allowlist pattern for mount paths — absolute path with safe characters only. */
const SAFE_MOUNT_PATH = /^\/[a-zA-Z0-9_.\-/]+$/;

function validateMountPath(mountPath: string): void {
  if (!SAFE_MOUNT_PATH.test(mountPath)) {
    throw new Error(
      `Invalid mount path: ${mountPath}. Must be an absolute path with alphanumeric, dash, dot, underscore, or slash characters only.`,
    );
  }
  const segments = mountPath.split('/').filter(Boolean);
  if (segments.length === 0) {
    throw new Error(`Invalid mount path: ${mountPath}. Root path "/" is not allowed.`);
  }
  if (segments.some(seg => seg === '.' || seg === '..')) {
    throw new Error(`Invalid mount path: ${mountPath}. Path segments cannot be "." or "..".`);
  }
}

/** Canonicalize mount path so `/data`, `/data/`, `//data` all resolve to `/data`. */
function normalizeMountPath(mountPath: string): string {
  return `/${mountPath.split('/').filter(Boolean).join('/')}`;
}

// =============================================================================
// Local Sandbox
// =============================================================================

/**
 * Local sandbox provider configuration.
 */
export interface LocalSandboxOptions extends Omit<MastraSandboxOptions, 'processes'> {
  /** Unique identifier for this sandbox instance */
  id?: string;

View on GitHub (pinned to 75dd419e61)

Solutions

Normalize the path first and reject it if any segment is `.` or `..` (or verify the normalized path still starts with the intended root)
Sanitize user input: strip or reject `..` sequences before constructing the mount path
Use path.resolve and confirm the result is under the allowed sandbox root

Example fix

// before
sandbox.mount(`/data/${userSubdir}`); // userSubdir could be '../etc'
// after
const seg = userSubdir.split('/').filter(Boolean);
if (seg.some(s => s === '.' || s === '..')) throw new Error('Illegal path segment');
sandbox.mount(`/data/${seg.join('/')}`);

Defensive patterns

Strategy: validation

Validate before calling

function assertNoTraversal(p: string) {
  const segs = p.split('/').filter(Boolean);
  if (segs.some(s => s === '.' || s === '..')) throw new Error(`Path segment '.' or '..' not allowed in: ${p}`);
}

Try / catch

try {
  await sandbox.mount(`/data/${userSub}`);
} catch (err) {
  if (/segments cannot be/.test(String(err?.message))) {
    throw new Error(`Refusing traversal in subpath: ${userSub}`);
  }
  throw err;
}

Prevention

Treat any user-supplied path segment as untrusted: sanitize to [a-zA-Z0-9_.-] before joining
Reject '..' outright rather than normalizing it away — normalization can hide intent
Write a unit test that mounts with '../' inputs to lock in the rejection behavior

When it happens

Trigger: Calling `sandbox.mount('/data/../etc')`, `sandbox.mount('/./data')`, or passing user input that includes `..` traversal; joining paths from untrusted config that contain `..`.

Common situations: Building mount paths from user-supplied subpaths without normalization; template strings like `/mnt/${name}` where name contains `..`; attempting to reach outside the sandbox root via traversal.

Related errors

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/3ae00e5613417d47. Report an issue: GitHub.