CVE-2026-19324 in shadcn-vue-mcp
Summary
by MITRE • 08/09/2026
A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restricted to local execution. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/09/2026
The vulnerability identified in HelloGGX shadcn-vue-mcp represents a critical path traversal weakness that could potentially allow unauthorized access to sensitive files on the local system. This security flaw exists within the file src/server/callback-server.ts where the fs.promises.readFile function is improperly handling user-supplied filepath arguments without adequate validation or sanitization. The issue manifests when an attacker can manipulate the filepath parameter to traverse directories beyond the intended scope, potentially accessing system files that should remain restricted.
This vulnerability falls under the CWE-22 category of Path Traversal attacks, which is a well-documented security weakness in software applications that process file paths without proper input validation. The attack vector is specifically limited to local execution scenarios, meaning that remote exploitation is not possible through network-based attacks. However, the impact remains significant for local system compromise, particularly when the application is running with elevated privileges or when sensitive data is stored in accessible locations within the file system.
The operational impact of this vulnerability extends beyond simple file access, as it could potentially expose configuration files, database credentials, or other sensitive information that might be stored in predictable locations relative to the application's installation directory. The rolling release strategy employed by this project creates additional challenges for remediation efforts since there are no clear version identifiers for affected releases, making it difficult for users to determine if their installations are vulnerable without conducting detailed code analysis.
Security practitioners should note that this vulnerability aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter: PowerShell, as path traversal attacks often involve manipulating file paths to execute commands or access resources that would otherwise be restricted. The lack of response from the project maintainers since early issue reporting indicates a potential gap in security maintenance processes, which could leave users exposed to further exploitation opportunities.
Mitigation strategies should include immediate implementation of input validation for all filepath parameters passed to fs.promises.readFile operations, including canonicalization checks and directory traversal prevention measures. Organizations should also implement proper access controls and privilege separation to limit the damage that could occur if path traversal attacks succeed. Additionally, regular security audits of application code should be conducted to identify similar vulnerabilities in other file system operations, particularly those involving user-supplied input that may not be properly sanitized before being processed by system functions.
The vulnerability demonstrates the importance of secure coding practices and input validation, particularly when dealing with file system operations that are frequently targeted by attackers seeking to gain unauthorized access to system resources. Given the nature of path traversal attacks, defensive measures should include comprehensive testing of all file path handling code segments and implementation of automated security scanning tools to identify similar weaknesses across the application's attack surface.