Shadcn Vue Mcp
Monthly
Path traversal in HelloGGX shadcn-vue-mcp allows low-privileged local users to read arbitrary files outside the intended directory by supplying crafted filepath arguments to the fs.promises.readFile call in src/server/callback-server.ts. All releases up to commit e170e277b94235cde627803277fc8c41103a4d38 are affected, with no vendor patch available and the maintainer having not responded to the disclosure. A proof-of-concept is indicated by the E:P modifier in the CVSS 4.0 vector, though exploitation is confined to local access scenarios with limited confidentiality impact and no integrity or availability consequence.
Path traversal in HelloGGX shadcn-vue-mcp allows low-privileged local users to read arbitrary files outside the intended directory by supplying crafted filepath arguments to the fs.promises.readFile call in src/server/callback-server.ts. All releases up to commit e170e277b94235cde627803277fc8c41103a4d38 are affected, with no vendor patch available and the maintainer having not responded to the disclosure. A proof-of-concept is indicated by the E:P modifier in the CVSS 4.0 vector, though exploitation is confined to local access scenarios with limited confidentiality impact and no integrity or availability consequence.