EUVD-2026-54859
GHSA-866p-rrc7-6r5x
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack vector and low-privilege requirement confirmed by both description and CVSS 4.0 input; limited and equal CIA impact from path traversal with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed locally. Upgrading to version 0.1.1 is recommended to address this issue. The identifier of the patch is 855b46739e0f6e8388f17f9d0066ac4298a3965d. Upgrading the affected component is recommended.
AnalysisAI
Path traversal in aktsmm skill-ninja-mcp-server 0.1.0 exposes four installer functions - getInstalledSkills, installSkill, updateAgentsMd, and uninstallSkill - in src/installer.ts to directory escape via an unsanitized workspacePath argument. The CVSS 4.0 vector (AV:L/PR:L) confirms exploitation is strictly local and requires low-privilege OS access, substantially limiting opportunistic reach. A patched release (v0.1.1) is available on GitHub; the E:P supplemental metric signals proof-of-concept exploit code exists, though no active exploitation has been confirmed by CISA KEV.
Technical ContextAI
skill-ninja-mcp-server is a Model Context Protocol (MCP) server (CPE: cpe:2.3:a:aktsmm:skill-ninja-mcp-server:*:*:*:*:*:*:*:*) used to install, update, and remove AI agent skills within developer workspaces, typically integrated with editors such as VS Code. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the workspacePath parameter supplied to the four installer entry points in src/installer.ts is not sanitized or canonicalized before being passed to filesystem operations. An attacker can inject sequences such as '../../' to escape the intended workspace root and access or modify arbitrary files accessible to the server process. The flaw is confined to the installer module; all four exposed MCP tool functions share the same vulnerable code path.
RemediationAI
Upgrade to skill-ninja-mcp-server version 0.1.1, which contains the confirmed security fix at commit 855b46739e0f6e8388f17f9d0066ac4298a3965d. The patched release is available at https://github.com/aktsmm/skill-ninja-mcp-server/releases/tag/v0.1.1. If an immediate upgrade is not feasible, restrict the server process to an OS account with the minimum filesystem permissions required for the intended workspace directory - this constrains the directories reachable via path traversal. Specifically, avoid running the MCP server as root or under an account with write access to sensitive directories such as ~/.ssh or system configuration paths, as elevated permissions directly amplify path traversal impact. Restricting which local users can invoke MCP tool functions also reduces exposure.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today