CVE-2026-19279
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
In the MIMICLab mcp-pdf-vision project version 1.1.0, a command injection vulnerability was found in the load_pdf function in src/index.ts. Manipulating the pdfPath/sessionId arguments allows command execution, but the attack requires local access. The project has not responded to the report.
Risk Assessment
A local attack could allow someone with system access to execute arbitrary commands in the application context, potentially leading to privilege escalation or data integrity compromise.
Recommendation
Restrict local access to the system and monitor the project's response. Consider temporarily disabling the load_pdf function if possible.
Original NVD description (English source)
A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function load_pdf of the file src/index.ts. Such manipulation of the argument pdfPath/sessionId leads to command injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.