EUVD-2026-43264
GHSA-9cqv-qvmj-xrc4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack requiring low privileges to supply projectPath; write-capable traversal yields limited file read/write/overwrite with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component run_project. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.0.0 addresses this issue. The patch is identified as eb63add552aa4bd9205395cf91b40654654a3cf2. It is suggested to upgrade the affected component.
AnalysisAI
Path traversal in tugcantopaloglu godot-mcp 2.0.0 allows a local low-privileged user to escape the intended project directory by manipulating the projectPath argument passed to the validatePath function within the run_project component. A public proof-of-concept has been disclosed via GitHub issue #9, raising practical exploitability above the raw CVSS score of 4.8 would suggest. No active exploitation is confirmed by CISA KEV; a vendor-released patch is available in version 3.0.0.
Technical ContextAI
godot-mcp is a Model Context Protocol (MCP) server integration designed to bridge AI tooling with the Godot game engine, identified by CPE cpe:2.3:a:tugcantopaloglu:godot-mcp. The vulnerability originates in the validatePath function in build/index.js, which is responsible for sanitizing file system paths supplied to the run_project component. The root cause class is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the function fails to canonicalize or adequately normalize the projectPath argument before using it to access the file system, allowing traversal sequences such as '../' to escape the intended working directory. This pattern is a well-understood failure mode in JavaScript/Node.js file handling code where path.resolve() or equivalent canonicalization is omitted.
RemediationAI
Upgrade godot-mcp to version 3.0.0, which resolves the path traversal via commit eb63add552aa4bd9205395cf91b40654654a3cf2 (https://github.com/tugcantopaloglu/godot-mcp/commit/eb63add552aa4bd9205395cf91b40654654a3cf2); the patched release is available at https://github.com/tugcantopaloglu/godot-mcp/releases/tag/v3.0.0. If immediate upgrade is not feasible, restrict local system access to only trusted users who require interaction with the run_project component, reducing the pool of potential local attackers. Additionally, consider wrapping the MCP server invocation in a sandboxed environment (e.g., a container or restricted user account with minimal filesystem permissions) to limit the directories reachable via traversal - note that sandboxing adds operational complexity and does not address the underlying input validation defect.
Remote code execution in Godot MCP prior to version 0.1.1 results from unsafe shell command execution when processing us
Command injection in LeeSinLiang's godot-mcp 0.1.0 allows local low-privileged users to execute arbitrary OS commands by
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today