CVE-2026-19366
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In NocteDefensor LudusMCP up to version 1.0.24, a vulnerability was found in an unknown function of src/tools/insertCredsRangeConfig.ts (insert_creds_range_config component). Manipulation of the configPath/outputPath arguments leads to path traversal. The attack is restricted to local execution.
Risk Assessment
Path traversal vulnerability may allow an attacker to write or read files outside allowed locations, potentially leading to data integrity compromise.
Recommendation
It is recommended to validate the configPath/outputPath arguments, use secure base paths, and restrict access to the insert_creds_range_config function.
Original NVD description (English source)
A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component insert_creds_range_config. Executing a manipulation of the argument configPath/outputPath can lead to path traversal. The attack is restricted to local execution. The project was informed of the problem early through an issue report but has not responded yet.