CVE-2026-7212

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-7212
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7212.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-7212
Aliases
Published
2026-04-28T01:15:12.800Z
Modified
2026-07-15T01:48:53.319857236Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
edvardlindelof notes-mcp notes_mcp.py path traversal
Details

A security vulnerability has been detected in edvardlindelof notes-mcp up to 0.1.4. This affects an unknown function of the file notesmcp.py. The manipulation of the argument rootdir/path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7212.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "0.1.0"
                },
                {
                    "last_affected": "0.1.0"
                },
                {
                    "introduced": "0.1.1"
                },
                {
                    "last_affected": "0.1.1"
                },
                {
                    "introduced": "0.1.2"
                },
                {
                    "last_affected": "0.1.2"
                },
                {
                    "introduced": "0.1.3"
                },
                {
                    "last_affected": "0.1.3"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/edvardlindelof/notes-mcp

Affected ranges

Type
GIT
Repo
https://github.com/edvardlindelof/notes-mcp
Events
Introduced
8a895802ec311b2f2f3f47cbdc6f44d6e4ea9519
Last affected
8a895802ec311b2f2f3f47cbdc6f44d6e4ea9519
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.1.4"
        },
        {
            "last_affected": "0.1.4"
        }
    ]
}

Affected versions

0.*
0.1.4
v0.*
v0.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7212.json"