EUVD-2026-54956
GHSA-w5g7-c885-pm69
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector and low-privilege requirement enforced by AV:L and PR:L; C:L and I:L reflect limited file-scope impact; A:N because path traversal alone does not cause availability loss.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in new-mcp 0.1.0's geminithinking component permits a local low-privileged user to read, write, or probe arbitrary files by supplying crafted sessionCommand or sessionPath arguments to unsanitized Node.js fs calls in index.ts. The flaw was disclosed to the maintainer via GitHub issue #10 but has received no response or patch. No public exploit code or active exploitation has been confirmed at time of analysis, though the CVSS 4.0 supplemental E:P metric suggests proof-of-concept material exists.
Technical ContextAI
new-mcp 0.1.0 is a Node.js project (github.com/bartekke8it56w2/new-mcp) that implements a geminithinking component in index.ts. That component uses three Node.js built-in file-system APIs - fs.writeFileSync, fs.existsSync, and fs.readFileSync - to manage session state. The sessionCommand and sessionPath parameters supplied at invocation are passed directly to these APIs without path normalization, allow-list validation, or traversal sequence stripping, constituting a classic CWE-22 (Path Traversal) flaw. An attacker who controls those arguments can insert sequences such as '../../' to escape the intended working directory and target any file accessible to the OS account running the process. The vulnerability is scoped entirely to the local system; there is no network-facing attack surface identified in the available data.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the coordinated disclosure. As an immediate compensating control, sanitize sessionCommand and sessionPath inputs before passing them to any fs.* call: use Node.js path.resolve() to canonicalize the path, then assert that the resolved string begins with the intended base directory, rejecting any value that escapes it. This allow-list approach eliminates the traversal without removing functionality, though it requires code-level changes to index.ts. Additionally, run the new-mcp process under a dedicated OS user account with the narrowest possible filesystem permissions, limiting the blast radius if the traversal is triggered. Monitor https://github.com/bartekke8it56w2/new-mcp/issues/10 and https://vuldb.com/vuln/387254 for any future upstream fix. Alternatively, if the geminithinking component is not required, disable or remove it from the deployment.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today