EUVD-2026-53873
GHSA-h7vv-3j7j-4c9x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible tool requiring low-privilege authentication (PR:L); impact bounded to Low across C/I/A as traversal is constrained by process-level OS permissions, with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in MonomythDevelopment la-forge-mcp 1.0.0. This issue affects the function screenshotElement of the file src/index.ts of the component screenshot_element Tool. Such manipulation of the argument output_name leads to path traversal. The attack can be executed remotely. Upgrading to version 1.1.1 is capable of addressing this issue. The name of the patch is 1102172c9adec4a619e241efd6bfb74f5b1f4332. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
AnalysisAI
Path traversal in MonomythDevelopment la-forge-mcp 1.0.0 enables low-privileged authenticated users to write files outside the server's intended reference directory via the screenshot_element MCP tool. The screenshotElement function in src/index.ts constructed output file paths using unsanitized user-supplied selector or output_name arguments, allowing traversal sequences to escape REF_DIR entirely. A public proof-of-concept exists (CVSS E:P; referenced in gongyaugugyy/public_exp/issues/12), though no CISA KEV listing has been identified and the overall CVSS 4.0 score of 2.1 reflects the bounded, low-impact nature of this finding.
Technical ContextAI
la-forge-mcp is a TypeScript/Node.js Model Context Protocol (MCP) server providing browser automation capabilities, including a screenshot_element tool that captures and persists screenshots of DOM elements. The root cause is CWE-22 (Path Traversal): the pre-patch screenshotElement function in src/index.ts built the output filename by applying only superficial character replacements (spaces to underscores, stripping dots and hashes) before passing the result directly to path.join(REF_DIR, ...). This normalization did not strip ../ sequences, allowing a crafted argument to escape REF_DIR. The fix (commit 1102172c9adec4a619e241efd6bfb74f5b1f4332) introduces two layered defenses: sanitizeName() for character normalization and resolveInRefDir(), which uses path.resolve() plus a directory-prefix assertion to guarantee no write leaves the reference directory regardless of platform-specific path quirks. No CPE string was provided in the input data; the affected component is identified solely via the GitHub repository.
RemediationAI
Upgrade la-forge-mcp to version 1.1.1, which was released by the vendor specifically to address this vulnerability. The patched release is available at https://github.com/MonomythDevelopment/la-forge-mcp/releases/tag/v1.1.1 and the fix commit is 1102172c9adec4a619e241efd6bfb74f5b1f4332 (https://github.com/MonomythDevelopment/la-forge-mcp/commit/1102172c9adec4a619e241efd6bfb74f5b1f4332). If immediate upgrade is not feasible, restrict invocation of the MCP server to the narrowest possible set of trusted, authenticated users to reduce the blast radius of the PR:L exploitation requirement; note this is a compensating control only, not a fix, and does not prevent exploitation by any authorized low-privileged user. Additionally, monitor the REF_DIR directory and its parent paths for unexpected files as a detection measure. No configuration-level workaround eliminates the vulnerability without the code change.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today