React Analyzer Mcp
Monthly
Path traversal in azer's react-analyzer-mcp MCP server allows local low-privilege attackers to read or write files outside the intended project directory by supplying crafted input to the `projectName` argument of the `generateProjectDocs` function in `src/index.ts`. All commits up to 335f2a3585f265e2e88352b59b10d3b478d678b0 are affected, with no vendor-released patch available as the maintainer has not yet responded to the disclosure via GitHub issue. No public exploit identified at time of analysis, though the CVSS 4.0 E:P modifier indicates a proof-of-concept exists, and the attack is constrained to local authenticated access only.
Path traversal in azer's react-analyzer-mcp MCP server allows local low-privilege attackers to read or write files outside the intended project directory by supplying crafted input to the `projectName` argument of the `generateProjectDocs` function in `src/index.ts`. All commits up to 335f2a3585f265e2e88352b59b10d3b478d678b0 are affected, with no vendor-released patch available as the maintainer has not yet responded to the disclosure via GitHub issue. No public exploit identified at time of analysis, though the CVSS 4.0 E:P modifier indicates a proof-of-concept exists, and the attack is constrained to local authenticated access only.