CVE-2026-15749
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A path traversal vulnerability was discovered in mastergo-design mastergo-magic-mcp up to version 0.2.0 in the execute function of src/tools/get-c2d.ts (component mcp__C2d). The attack requires local access and manipulation of the filePath argument. The exploit is public, and the project has not responded to the issue report.
Risk Assessment
The risk involves potential unauthorized read or write of files outside the allowed directory by a local attacker, which could lead to data leakage or privilege escalation on the system.
Recommendation
Immediately update mastergo-magic-mcp to the latest available version (if any) or apply temporary mitigations such as input path validation and restricting access to sensitive files.
Other vulnerabilities in mastergo-magic-mcp
See all- CVE-2026-15751Medium
A security vulnerability was found in mastergo-design mastergo-magic-mcp up to version 0.2.0 in the execute function of the mastergo/component-workflow.md file of the mcp__getComponentGenerator component. Manipulation of the rootPath argument leads to path traversal, allowing access to files outside the intended directory. The attack requires local access, and the exploit has been publicly disclosed.
- CVE-2026-15750Medium
A server-side request forgery (SSRF) vulnerability has been identified in the mastergo-magic-mcp library up to version 0.2.0. The issue is in the z.string function in the file src/tools/get-component-link.ts, where manipulation of the url argument can lead to requests to arbitrary resources. The attack can be performed remotely, and the exploit has been made public.
Original NVD description (English source)
A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function execute of the file src/tools/get-c2d.ts of the component mcp__C2d. Performing a manipulation of the argument filePath results in path traversal. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.