CVE-2026-19370
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In bartekke8it56w2 new-mcp 0.1.0, a vulnerability was found in the fs.writeFileSync/fs.existsSync/fs.readFileSync functions of index.ts (geminithinking component). Manipulation of the sessionCommand/sessionPath arguments leads to path traversal. The attack requires local access.
Risk Assessment
Path traversal vulnerability may allow an attacker to write, read, or check existence of arbitrary files, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to validate the sessionCommand/sessionPath arguments, use secure base paths, and restrict access to these functions.
Original NVD description (English source)
A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.