mastergo-magic-mcp vulnerabilities

A security vulnerability was found in mastergo-design mastergo-magic-mcp up to version 0.2.0 in the execute function of the mastergo/component-workflow.md file of the mcp__getComponentGenerator component. Manipulation of the rootPath argument leads to path traversal, allowing access to files outside the intended directory. The attack requires local access, and the exploit has been publicly disclosed.

A server-side request forgery (SSRF) vulnerability has been identified in the mastergo-magic-mcp library up to version 0.2.0. The issue is in the z.string function in the file src/tools/get-component-link.ts, where manipulation of the url argument can lead to requests to arbitrary resources. The attack can be performed remotely, and the exploit has been made public.

A path traversal vulnerability was discovered in mastergo-design mastergo-magic-mcp up to version 0.2.0 in the execute function of src/tools/get-c2d.ts (component mcp__C2d). The attack requires local access and manipulation of the filePath argument. The exploit is public, and the project has not responded to the issue report.