CVE-2026-15751

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-15751
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15751.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-15751
Published
2026-07-14T22:00:10.375Z
Modified
2026-07-17T03:41:52.239622166Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal
Details

A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the function execute of the file mastergo/component-workflow.md of the component mcp__getComponentGenerator. The manipulation of the argument rootPath leads to path traversal. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15751.json",
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/mastergo-design/mastergo-magic-mcp

Affected ranges

Type
GIT
Repo
https://github.com/mastergo-design/mastergo-magic-mcp
Events
Introduced
7c7f2e161183608e7f50f51a4bfb7487de22ceca
Last affected
189a1d01dbb2e03428179089a682d1d2f527bdb0
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.1"
        },
        {
            "last_affected": "0.1"
        },
        {
            "introduced": "0.2.0"
        },
        {
            "last_affected": "0.2.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1
0.2.0
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.4
v0.1.5
v0.1.6
v0.1.6-beta.0
v0.1.6-beta.1
v0.1.6-beta.2
v0.1.6-beta.3
v0.1.6-beta.4
v0.1.7
v0.1.7-beta.0
v0.1.8
v0.1.9-alpha.0
v0.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15751.json"