mcp-pdf-vision CVE-2026-19279

Q: What is the CVSS score of CVE-2026-19279?

CVE-2026-19279 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-54778 LOW

Command Injection (CWE-77)

2026-08-08 VulDB

GHSA-jgc6-5vgc-hvqg

Command Injection Mcp Pdf Vision

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Local-only vector with low-privilege requirement confirmed by description and CVSS 4.0 AV:L/PR:L; limited uniform impact with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 08, 2026 - 11:22 NVD

MEDIUM LOW

CVSS changed

Aug 08, 2026 - 11:22 NVD

4.8 (MEDIUM) 1.9 (LOW)

Analysis Generated

Aug 08, 2026 - 10:51 vuln.today

DescriptionCVE.org

A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function load_pdf of the file src/index.ts. Such manipulation of the argument pdfPath/sessionId leads to command injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Command injection in MIMICLab mcp-pdf-vision 1.1.0 allows a local low-privileged attacker to execute arbitrary OS commands by supplying crafted values to the pdfPath or sessionId arguments of the load_pdf function in src/index.ts. The CVSS 4.0 score of 4.8 (Medium) reflects a local-only attack surface with limited confidentiality, integrity, and availability impact; no scope change to subsequent systems is possible. A proof-of-concept exists per the E:P exploit maturity indicator in the CVSS 4.0 vector, and no patch has been released - the vendor has not responded to the responsible disclosure filed via GitHub issue.

Technical ContextAI

mcp-pdf-vision is a Model Context Protocol (MCP) server tool by MIMICLab designed to process and extract content from PDF files, likely for use by AI agent pipelines. The vulnerability is rooted in CWE-77 (Improper Neutralization of Special Elements used in a Command), where the load_pdf function in src/index.ts constructs a shell command incorporating user-controlled arguments - pdfPath and/or sessionId - without adequate sanitization. Shell metacharacters (e.g., semicolons, backticks, pipes) embedded in these arguments alter the intended command, causing the process to execute attacker-supplied instructions. The CPE string cpe:2.3:a:mimiclab:mcp-pdf-vision:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the affected range to a specific version beyond the reported 1.1.0.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor was notified via GitHub issue (https://github.com/MIMICLab/mcp-pdf-vision/issues/1) and has not responded. As a primary compensating control, avoid passing any untrusted or externally-sourced input to the pdfPath or sessionId parameters of the load_pdf function; enforce strict allowlisting of PDF file paths to known, safe directories (e.g., an absolute path whitelist) to prevent injection via path manipulation. Restricting the MCP server to accept invocations only from trusted, local privileged processes reduces the attack surface. If PDF processing from untrusted sources is not required, disabling or removing the mcp-pdf-vision tool from the MCP agent configuration entirely eliminates exposure with no functional impact on unrelated workflows. Monitor the GitHub repository for a patched release and apply it promptly when available.