CVE-2026-15751
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A security vulnerability was found in mastergo-design mastergo-magic-mcp up to version 0.2.0 in the execute function of the mastergo/component-workflow.md file of the mcp__getComponentGenerator component. Manipulation of the rootPath argument leads to path traversal, allowing access to files outside the intended directory. The attack requires local access, and the exploit has been publicly disclosed.
Risk Assessment
The organization is at risk of unauthorized reading or modification of system files by a local attacker, potentially leading to data leakage or system integrity compromise.
Recommendation
Immediately update mastergo-magic-mcp to a version newer than 0.2.0 if available, or apply temporary mitigations such as restricting access to the execute function and validating the rootPath argument.
Other vulnerabilities in mastergo-magic-mcp
See all- CVE-2026-15750Medium
A server-side request forgery (SSRF) vulnerability has been identified in the mastergo-magic-mcp library up to version 0.2.0. The issue is in the z.string function in the file src/tools/get-component-link.ts, where manipulation of the url argument can lead to requests to arbitrary resources. The attack can be performed remotely, and the exploit has been made public.
- CVE-2026-15749Medium
A path traversal vulnerability was discovered in mastergo-design mastergo-magic-mcp up to version 0.2.0 in the execute function of src/tools/get-c2d.ts (component mcp__C2d). The attack requires local access and manipulation of the filePath argument. The exploit is public, and the project has not responded to the issue report.
Original NVD description (English source)
A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the function execute of the file mastergo/component-workflow.md of the component mcp__getComponentGenerator. The manipulation of the argument rootPath leads to path traversal. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.