EUVD-2026-54851
GHSA-3r2r-p86c-vj94
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only execution with low-privilege OS access yields only limited file read via path traversal; no integrity, availability, or scope-change impact applies.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restricted to local execution. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in HelloGGX shadcn-vue-mcp allows low-privileged local users to read arbitrary files outside the intended directory by supplying crafted filepath arguments to the fs.promises.readFile call in src/server/callback-server.ts. All releases up to commit e170e277b94235cde627803277fc8c41103a4d38 are affected, with no vendor patch available and the maintainer having not responded to the disclosure. A proof-of-concept is indicated by the E:P modifier in the CVSS 4.0 vector, though exploitation is confined to local access scenarios with limited confidentiality impact and no integrity or availability consequence.
Technical ContextAI
shadcn-vue-mcp is a Node.js-based Model Context Protocol (MCP) server that integrates shadcn-vue UI component tooling. The vulnerable code path in src/server/callback-server.ts passes a user-controlled filepath argument directly into Node.js's fs.promises.readFile without canonicalization, path normalization, or boundary enforcement. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) defect: by embedding ../ sequences or supplying absolute paths, a caller can cause the function to resolve files well outside the intended serving directory. The affected CPE cpe:2.3:a:helloggx:shadcn-vue-mcp:*:*:*:*:*:*:*:* covers all releases with no upper-bound version, consistent with the project's rolling release model.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the disclosure filed at GitHub issue #14. As an immediate compensating control, run the shadcn-vue-mcp server under a dedicated OS user account with filesystem permissions restricted exclusively to the intended component directory, directly limiting which files a successful path traversal can reach - note this does not eliminate the flaw but reduces the blast radius. Containerizing the server process (Docker, systemd-nspawn, or equivalent) with a minimal read-only bind mount further constrains reachable paths. Organizations should monitor the upstream repository at https://github.com/HelloGGX/shadcn-vue-mcp/ and VulDB entry https://vuldb.com/vuln/387158 for patch commits. If local-only access to the server can be enforced at the OS or network boundary, that removes the practical attack surface entirely without requiring a code fix.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today