CVE-2026-19281
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack is only possible with local access. The project was informed of the problem early through an issue report but has not responded yet.
Risk Assessment
The risk includes the possibility of executing arbitrary system commands by a local attacker, potentially leading to full system compromise or data breach.
Recommendation
Restrict local access to the system and monitor for a patch from the project. Also check for possible mitigations.
Original NVD description (English source)
A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack is only possible with local access. The project was informed of the problem early through an issue report but has not responded yet.