designer-mcp CVE-2026-116045

Exploitation requires the attacker to be a connected MCP client able to invoke the get_reference tool of the designer-mcp MCP Interface (PR:L - authenticated per the CVSS 4.0 vector). The vulnerable get_reference function in skills/motion-designer/references concatenated the Name argument directly into a filesystem path and appended a '.md' extension, so traversal was constrained to Markdown-suffixed files, and impact is limited to low confidentiality (file read) with no write or availability effect. Limiting factors: the caller must hold MCP-client access to the tool, the read is restricted to '.md'-extension targets, and deployments that run the server locally over stdio rather than exposing it on a network materially reduce real-world reachability. Affected: designer-mcp up to 2.1.0; fixed by commit c8c2951dcbed9b1710a745993f028317f10a3f10 (no version numbers due to rolling releases).

This is a moderate-severity, low-urgency issue rather than a top priority. The supplied CVSS 4.0 vector (5.3) describes a network-accessible flaw with low attack complexity but requiring privileges (PR:L) and yielding only low confidentiality impact (VC:L) with no integrity or availability impact (VI:N/VA:N). The E:P exploit-maturity modifier reflects a proof-of-concept, consistent with the input noting a PoC reference that is not verified as working exploit code. There is no CISA KEV listing and no EPSS score in the provided data, so exploitation-probability cannot be quantified; the vuln.today decision label is 'this_month', not act_now or emergency. The SSVC-style signals therefore agree on limited urgency: a confirmed but unweaponized read-only path traversal in a niche MCP server. One caveat to verify: the description and CVSS both assert remote/network exploitation (AV:N), but designer-mcp is a Model Context Protocol server that is frequently run locally over stdio (the vendor's own regression test 'drives the real server over stdio'), so the true attack vector depends on whether a given deployment exposes the MCP interface over a network - verify against the actual deployment model.

An attacker who can act as a connected MCP client invokes the get_reference tool and supplies a Name argument containing directory-traversal sequences; because the pre-patch code concatenated the argument directly into a path under the references directory (appending a .md extension), the server resolves and returns a Markdown file outside the intended skill directory. A public PoC reference exists (a GitHub issue), but it is not verified as working exploit code.