Spec Workflow Mcp
Monthly
Path traversal in Pimzino spec-workflow-mcp versions up to 2.2.6 allows a local low-privileged user to write approval files outside the intended .spec-workflow/approvals directory by supplying crafted values such as '../../../etc/cron.d/evil' as the categoryName argument to ApprovalStorage.createApproval(). The vulnerability is strictly local (AV:L, PR:L) and carries a CVSS 4.0 score of 4.8, indicating limited blast radius. No public exploit code and no CISA KEV listing exist at time of analysis; version 2.2.7, released 2026-05-04, fully remediated the issue.
Path traversal in Pimzino spec-workflow-mcp versions up to 2.2.6 allows a local low-privileged user to write approval files outside the intended .spec-workflow/approvals directory by supplying crafted values such as '../../../etc/cron.d/evil' as the categoryName argument to ApprovalStorage.createApproval(). The vulnerability is strictly local (AV:L, PR:L) and carries a CVSS 4.0 score of 4.8, indicating limited blast radius. No public exploit code and no CISA KEV listing exist at time of analysis; version 2.2.7, released 2026-05-04, fully remediated the issue.