CVE-2026-19330
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0, in the function create_system_json/create_library to get_system_json/switch_memory_library of the file src/index.ts. This manipulation causes path traversal. The attack requires local access. The project was informed but has not responded.
Risk Assessment
A local attacker can access files outside the allowed directory, potentially leading to disclosure of sensitive data or integrity compromise.
Recommendation
Wait for patches from the vendor and restrict local access to the application.
Original NVD description (English source)
A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is the function create_system_json/create_library to get_system_json/switch_memory_library of the file src/index.ts. This manipulation causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.