EUVD-2026-43269
GHSA-v62x-f943-965f
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only path traversal with low-privilege requirement and limited read-only confidentiality impact; no integrity, availability, or scope change applies.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file src/tools/v4/scan-project-deps.ts of the component scan_project_deps. Executing a manipulation of the argument packageJsonPath can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in augmnt augments-mcp-server 7.1.0 allows a local low-privileged attacker to read arbitrary files outside the intended project directory by manipulating the packageJsonPath argument passed to the scanProjectDeps function. The vulnerability is limited to confidentiality impact (VC:L) with no integrity or availability effect, and a proof-of-concept has been publicly disclosed via a GitHub issue. The vendor has not responded to the responsible disclosure report, meaning no patch is currently available.
Technical ContextAI
augments-mcp-server is a Model Context Protocol (MCP) server - an integration layer that exposes tools to AI coding assistants. The affected component is the scan_project_deps tool, implemented in src/tools/v4/scan-project-deps.ts, whose scanProjectDeps function accepts a user-controlled packageJsonPath argument. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) applies: the function fails to sanitize or canonicalize the path before using it to open or reference a file, allowing sequences such as '../../../etc/passwd' to escape the intended project root. Because MCP servers typically run as a local process on the developer's machine, the attack vector is inherently local (AV:L in CVSS 4.0 terms), and the CPE cpe:2.3:a:augmnt:augments-mcp-server:*:*:*:*:*:*:*:* indicates this is a pure software package with no appliance or SaaS context.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project was informed via responsible disclosure but has not responded. As a primary compensating control, operators should avoid passing any user-supplied or externally influenced strings as the packageJsonPath argument to scanProjectDeps; restricting this value to a hardcoded or validated absolute path within the project root eliminates the traversal vector. If the MCP server is deployed in a shared or multi-tenant environment, sandboxing the server process using a chroot jail or container with a restricted filesystem view is an effective mitigation, with the trade-off of increased operational complexity. Consumers of this package should monitor the GitHub repository at https://github.com/augmnt/augments-mcp-server/ and the VulDB entry at https://vuldb.com/cve/CVE-2026-15526 for vendor response and patch availability. Pinning to a patched release once one is published is the recommended long-term fix.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today