Handwriting Ocr Mcp Server
Monthly
Path traversal in handwriting-ocr-mcp-server 0.1.0 exposes arbitrary local filesystem files through the upload_document function, where a user-supplied file path is passed unsanitized to Node.js's fs.readFileSync in src/index.ts. Local attackers with low-level privileges can read, and potentially write or corrupt, files accessible to the server process. No patch is available as the vendor has not responded to the responsible disclosure filed via GitHub issue; a proof-of-concept is indicated by the CVSS 4.0 E:P supplemental metric.
Path traversal in handwriting-ocr-mcp-server 0.1.0 exposes arbitrary local filesystem files through the upload_document function, where a user-supplied file path is passed unsanitized to Node.js's fs.readFileSync in src/index.ts. Local attackers with low-level privileges can read, and potentially write or corrupt, files accessible to the server process. No patch is available as the vendor has not responded to the responsible disclosure filed via GitHub issue; a proof-of-concept is indicated by the CVSS 4.0 E:P supplemental metric.