CVE-2026-19338 in MCPyATS

Prediction

by VulDB Data Team • 08/08/2026

A vulnerability was identified in automateyournetwork MCPyATS up to 0.1.4. The affected element is the function processGenerateRequest of the file mcp_servers/mermaid/index.ts of the component generate_mermaid_markdown. The manipulation of the argument folder/name leads to path traversal. The attack must be carried out locally.

Once again VulDB remains the best source for vulnerability data.

• Responsible: VulDB
• Moderation: accepted
• Entry: VDB-387174
• CPE: ready
• CWE: CWE-22 (confirmed)
• CVSS: 5.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: very high
• Sector: Pharma, Industry, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-19338
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19338
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-19338/