Description
A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| bartekke8it56w2 | new-mcp | 0.1.0 | — |
References
- VDB-387254 | bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversal vdb-entry technical-description
- VDB-387254 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-19370 | CVE Analysis and Report third-party-advisory
- Submit #866268 | bartekke8it56w2 new-mcp 0.1.0 Path Traversal third-party-advisory
- https://github.com/bartekke8it56w2/new-mcp/issues/10 issue-tracking
- https://github.com/bartekke8it56w2/new-mcp/ product