EUVD-2026-44571
GHSA-2957-9wvx-x9f4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only invocation via MCP tool requires low privilege; traversal yields limited file read/write, no scope change or high-impact system compromise.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the function execute of the file mastergo/component-workflow.md of the component mcp__getComponentGenerator. The manipulation of the argument rootPath leads to path traversal. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in mastergo-magic-mcp versions up to 0.2.0 allows local low-privileged attackers to read and write files outside the intended working directory by supplying manipulated path sequences via the rootPath argument of the mcp__getComponentGenerator component's execute function. A public proof-of-concept exploit has been disclosed (CVSS 4.0 E:P), and the vendor has not responded to the issue report, leaving no patch available at time of analysis. No public exploitation (CISA KEV) has been confirmed, and the local-only attack vector significantly constrains the realistic threat surface.
Technical ContextAI
mastergo-magic-mcp is a Model Context Protocol (MCP) server integration for MasterGo, a cloud-based UI/UX design platform analogous to Figma. The vulnerable code path is the execute function declared in mastergo/component-workflow.md, which backs the mcp__getComponentGenerator MCP tool. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes the root cause: the rootPath parameter accepted by this tool is not sanitized against traversal sequences such as ../, allowing resolution of paths outside the intended component directory root. Because MCP servers execute as local processes invoked by an AI assistant client (e.g., Claude Desktop), exploitation requires that an attacker control input to the MCP call - either as a local user, via a compromised MCP client, or through a malicious AI prompt that injects a traversal payload into a legitimate workflow invocation. No CPE string was provided in the input data; the affected package is mastergo-design/mastergo-magic-mcp on GitHub.
RemediationAI
No vendor-released patch has been identified at time of analysis. The vendor was notified via GitHub issue #90 (https://github.com/mastergo-design/mastergo-magic-mcp/issues/90) but has not responded. As compensating controls: disable the mcp__getComponentGenerator tool in the MCP server configuration if component generation is not actively needed, as this removes the vulnerable code path entirely with no impact on unrelated MCP tools. If the tool must remain enabled, apply an allowlist validation on the rootPath argument server-side to reject any value containing .. sequences, null bytes, or absolute paths outside the designated component root directory - note that blocklist approaches are insufficient due to encoding bypasses. Restrict local user access to the host running the MCP server to the minimum required set. Monitor https://github.com/mastergo-design/mastergo-magic-mcp/ for a patched release and prioritize upgrading once available.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today