EUVD-2026-54863
GHSA-rgqf-fgw4-cmhv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with low privileges required to invoke vulnerable path functions; no scope change; limited read/write/availability impact on local files only.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is the function create_system_json/create_library to get_system_json/switch_memory_library of the file src/index.ts. This manipulation causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in angrysky56 advanced-reasoning-mcp 1.0.0 exposes the local file system to read and write operations outside the application's intended directory scope. The vulnerable functions create_system_json, create_library, get_system_json, and switch_memory_library in src/index.ts accept user-controlled path inputs without adequate sanitization, enabling directory escape via traversal sequences. A proof-of-concept exists per the CVSS 4.0 E:P modifier; however, exploitation is constrained to local, low-privilege access, and the project maintainer has not yet responded to the disclosure.
Technical ContextAI
The affected product is advanced-reasoning-mcp 1.0.0 (CPE: cpe:2.3:a:angrysky56:advanced-reasoning-mcp:*:*:*:*:*:*:*:*), an MCP (Model Context Protocol) server implementation written in TypeScript, designed for advanced reasoning workflows. CWE-22 (Path Traversal) identifies the root cause class: the application constructs file system paths using user-supplied input in the functions create_system_json, create_library, get_system_json, and switch_memory_library within src/index.ts, without canonicalizing or validating those inputs against an allowlisted base directory. This allows '../' sequences or absolute path components to escape the intended working directory. MCP servers typically run as local daemon processes and expose an API surface to local clients, which defines the attack surface as local rather than network-facing.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer was notified via GitHub issue (https://github.com/angrysky56/advanced-reasoning-mcp/issues/3) but has not responded. Monitor the repository for any future release and upgrade immediately when a patched version appears. As a compensating control, restrict local system accounts that can invoke the advanced-reasoning-mcp service to only those strictly necessary, reducing the pool of potential exploiting users; removing unnecessary local accounts has no functional side effects. Additionally, deploy the process inside a containerized environment (e.g., Docker) with explicit read-only bind mounts and tightly scoped volume mappings to prevent traversal beyond the intended working directory, though this adds operational overhead. Enabling file system auditing or inotify-based monitoring for unexpected path access patterns (e.g., sequences containing '../') can provide detection capability in the absence of a patch.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today