EUVD-2026-54079
GHSA-6j8j-xrrf-px36
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with low privileges required to invoke MCP tool; read-only confidentiality impact limited to files accessible by process user; no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludus_environment_guides_search. Such manipulation of the argument guide_name leads to path traversal. Local access is required to approach this attack. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in NocteDefensor LudusMCP up to version 1.0.24 allows a low-privileged local user to read files outside the intended directory by manipulating the guide_name argument in the ludus_environment_guides_search tool component (src/tools/ludusEnvironmentGuidesSearch.ts). All 25 tracked releases from 1.0.0 through 1.0.24 are affected. No patch has been released - the vendor was notified via GitHub issue but has not responded at time of analysis. No public exploit identified at time of analysis, though a separate public exploit report issue exists on GitHub (gongyaugugyy/public_exp), indicating the finding has been disclosed beyond the vendor.
Technical ContextAI
LudusMCP is a Model Context Protocol (MCP) server built for the Ludus cyber range platform, implemented in TypeScript (Node.js). The affected component, ludus_environment_guides_search, exposes a tool that accepts a guide_name parameter and likely constructs a file path from it to serve documentation or environment guide content. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) applies: the application fails to sanitize or canonicalize the user-supplied guide_name before using it in a filesystem path operation, allowing sequences such as '../../../etc/passwd' to escape the intended base directory. CPE cpe:2.3:a:noctedefensor:ludusmcp:*:*:*:*:*:*:*:* covers all versions through 1.0.24. As an MCP server, LudusMCP is invoked locally by AI agent frameworks or tooling, meaning the attack surface is local - a user or process with access to invoke MCP tool calls can trigger this traversal.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was informed via https://github.com/NocteDefensor/LudusMCP/issues/4 but has not responded. As a compensating control, users should restrict which identities or processes have permission to invoke the LudusMCP MCP server, reducing the pool of users who can supply arbitrary guide_name values. Specifically, configure the MCP host (e.g., Claude Desktop, a custom agent) to limit tool call permissions or disable the ludus_environment_guides_search tool if environment guide search is not operationally required - disabling it eliminates the attack surface entirely with no impact on other LudusMCP functions. Additionally, run the LudusMCP process under a dedicated low-privilege service account with filesystem access scoped only to the intended guides directory using OS-level controls (e.g., chroot, AppArmor, or filesystem ACLs), so that even a successful path traversal cannot read sensitive files outside that scope. Monitor the project repository at https://github.com/NocteDefensor/LudusMCP/ for a patched release.
Command injection in NocteDefensor LudusMCP through version 1.0.24 allows a local attacker with low privileges to execut
Command injection in NocteDefensor LudusMCP (all versions through 1.0.24) permits a local low-privileged attacker to exe
Path traversal in NocteDefensor LudusMCP (all versions up to 1.0.24) enables a locally authenticated low-privilege user
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today