CVE-2026-19324

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-19324
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19324.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-19324
Published
2026-08-09T01:30:11Z
Modified
2026-10-08T02:50:55Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal
Details

A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restricted to local execution. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19324.json"
}
References

Affected packages

Git / github.com/helloggx/shadcn-vue-mcp

Affected ranges

Type
GIT
Repo
https://github.com/helloggx/shadcn-vue-mcp
Events
Introduced
e170e277b94235cde627803277fc8c41103a4d38
Last Affected
e170e277b94235cde627803277fc8c41103a4d38

Affected versions

Other
e170e277b94235cde627803277fc8c41103a4d38

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19324.json"