Gongyanyu

**Name of the Vulnerable Software and Affected Versions** MonomythDevelopment la-forge-mcp versions prior to 1.1.1 **Description** A path traversal issue exists in the `screenshotElement()` function within the `src/index.ts` file of the `screenshot element` Tool. This flaw allows a remote attacker to manipulate the `output name` argument to access or write files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly validated. **Recommendations** Upgrade to version 1.1.1. As a temporary mitigation, restrict the use of the `output name` argument in the `screenshotElement()` function.

A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh exec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The attack requires a local approach. The actual existence of this vulnerability is currently in question. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project maintainer explains: "The intended threat model is that this MCP server is a local/trusted tool for an agent to execute commands over SSH, so callers already have meaningful execution capability through the exposed shell."

**Name of the Vulnerable Software and Affected Versions** MissionSquad mcp-api versions prior to 1.11.10 **Description** A remote flaw exists in a function within the `src/services/dcrClients.ts` file. This issue allows for server-side request forgery, a technique where an attacker induces the server to make requests to an unintended location. **Recommendations** Upgrade to version 1.11.10.

**Name of the Vulnerable Software and Affected Versions** MissionSquad mcp-api versions prior to 1.11.9 **Description** Command injection is possible via remote attack in the NPM Package Version Handler component. The issue resides in the `this.packageService.installPackage()` function within the `src/controllers/packages.ts` file. **Recommendations** Upgrade to version 1.11.9.

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create scene/add node. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.

**Name of the Vulnerable Software and Affected Versions** NocteDefensor LudusMCP versions prior to 1.0.25 **Description** Command injection is possible on the local host through the manipulation of the `Description` argument within the `SecretDialog.showSecretDialog()` function, located in the `src/utils/secretDialog.ts` file of the `get credential from user` component. **Recommendations** As a temporary workaround, restrict the use of the `SecretDialog.showSecretDialog()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** NocteDefensor LudusMCP versions prior to 1.0.25 **Description** A path traversal issue exists within the `ludus environment guides search` component, specifically in a function located in the `src/tools/ludusEnvironmentGuidesSearch.ts` file. This occurs when the `guide name` argument is manipulated, allowing an attacker with local access to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the use of the `guide name` argument in the `ludus environment guides search` component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NocteDefensor LudusMCP versions prior to 1.0.25 **Description** Command injection is possible through the manipulation of the `command` and `args` arguments. This issue resides within the `executeArbitraryCommand()` and `executeCommand()` functions located in the `src/ludusMCP/cliWrapper.ts` file of the `ludus cli execute` component. Exploitation requires local access to the system. **Recommendations** As a temporary workaround, restrict the use of the `executeArbitraryCommand()` and `executeCommand()` functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** lspace-server versions up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71 **Description** An issue in the Repositories File API component within the file `src/core/repository.ts` allows for path traversal—a method used to access files and directories that are stored outside the intended folder. This occurs when the `filePath` argument is manipulated within the `fileExists()`, `readFile()`, `writeFile()`, and `deleteFile()` functions. Exploitation requires local access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.