Mcfly_Zhang

A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component code task files. Executing a manipulation can lead to path traversal. The attack can be launched remotely. This patch is called 35d97bca0531894da36a85aedb95312da1bd5b7a. It is best practice to apply a patch to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** iswalle getnote-mcp versions prior to 1.5.1 **Description** A path traversal issue exists in the `upload image` component within the `src/index.ts` file. A remote attacker can exploit this by manipulating the `image path` argument passed to the `fs.readFileSync()` function. Path traversal is a technique used to access files and directories that are stored outside the intended folder. **Recommendations** Update to version 1.5.1. As a temporary mitigation, restrict access to the `upload image` component.

**Name of the Vulnerable Software and Affected Versions** AlexGladkov claude-in-mobile version 3.10.2 **Description** An OS command injection flaw exists in the `execSync()` function within the `src/adb/client.ts` file. This issue allows a local attacker to execute arbitrary operating system commands through manipulation of the function. **Recommendations** Upgrade to version 3.10.3.

**Name of the Vulnerable Software and Affected Versions** cyberchitta scrapling-fetch-mcp versions prior to 0.2.3 **Description** A remote attacker can execute a manipulation leading to server-side request forgery (SSRF), a condition where the server is coerced into making unauthorized requests to an arbitrary destination. The issue resides in the `s fetch page()` and `s fetch pattern()` functions within the `src/scrapling fetch mcp/ fetcher.py` file. **Recommendations** Update to version 0.2.3. As a temporary workaround, restrict the use of the `s fetch page()` and `s fetch pattern()` functions until the update is applied.

**Name of the Vulnerable Software and Affected Versions** MAA-AI MaaMCP versions prior to 1.1.1.dev6+g2e4a41287 **Description** A path traversal issue exists in the `save pipeline()` and `load pipeline()` functions within the `pipeline tools.py` file. This flaw allows a remote attacker to perform a manipulation that results in unauthorized access to files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** Deploy patch c93ef45cba75295eba26d9ff1ffb9202a91c6150 for versions prior to 1.1.1.dev6+g2e4a41287. As a temporary workaround, restrict the use of the `save pipeline()` and `load pipeline()` functions in `pipeline tools.py` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** arben-adm mcp-sequential-thinking versions prior to 0.6.0 **Description** A path traversal issue exists in the Import Session/Export Session component within the `mcp sequential thinking/server.py` file. Remote attackers can exploit this by manipulating the `file path` argument in the `import session()` and `export session()` functions. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences. **Recommendations** Update to version 0.6.0. As a temporary mitigation, restrict access to the `import session()` and `export session()` functions.

**Name of the Vulnerable Software and Affected Versions** mastergo-design mastergo-magic-mcp versions prior to 0.2.1 **Description** A remote server-side request forgery (SSRF) exists in the `mcp getComponentLink` component. The issue resides in the `z.string` function within the `src/tools/get-component-link.ts` file, where manipulation of the `url` argument allows an attacker to induce the server to make unauthorized requests. **Recommendations** As a temporary workaround, restrict the use of the `url` argument in the `mcp getComponentLink` component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mastergo-design mastergo-magic-mcp versions prior to 0.2.1 **Description** A path traversal issue exists in the `mcp C2d` component within the `execute()` function of the `src/tools/get-c2d.ts` file. A local attacker can manipulate the `filePath` argument to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly validated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `execute()` function in the `src/tools/get-c2d.ts` file or avoid using the `filePath` argument until a patch is available.

**Name of the Vulnerable Software and Affected Versions** mastergo-design mastergo-magic-mcp versions prior to 0.2.1 **Description** Path traversal occurs in the `execute()` function within the `mastergo/component-workflow.md` file of the `mcp getComponentGenerator` component. This issue arises from the improper handling of the `rootPath` argument, allowing a local attacker to access files and directories outside the intended folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tugcantopaloglu godot-mcp version 2.0.0 **Description** A path traversal issue exists in the `run project` component within the `validatePath()` function of the `build/index.js` file. This occurs when the `projectPath` argument is manipulated, allowing a local attacker to access files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly validated. **Recommendations** Upgrade to version 3.0.0. As a temporary mitigation, restrict access to the `validatePath()` function within the `run project` component.

**Name of the Vulnerable Software and Affected Versions** lamaalrajih kicad-mcp versions prior to 3.3.2 **Description** A failure in the protection mechanism occurs during the processing of the file `kicad mcp/utils/path validator.py`. This issue can be triggered by manipulating the `project path` or `schematic path` arguments. Successful exploitation requires local access to the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** better-auth better-icons versions prior to 1.0.6 **Description** A path traversal issue exists within the `scan project icons/sync icon` component. This occurs when the `icons file` argument is manipulated, allowing a local attacker to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** augmnt augments-mcp-server version 7.1.0 **Description** A path traversal flaw exists in the `scanProjectDeps()` function within the `src/tools/v4/scan-project-deps.ts` file of the `scan project deps` component. This issue occurs when the `packageJsonPath` argument is manipulated, allowing a local attacker to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** As a temporary workaround, restrict the use of the `packageJsonPath` argument in the `scanProjectDeps()` function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** kLOsk adloop versions prior to 0.10.0 **Description** A remote attacker can perform server-side request forgery (SSRF), a technique used to induce the server to make requests to an unintended location, by manipulating the `final url` argument within the ` validate urls()` function located in the src/adloop/ads/write.py file. **Recommendations** Update to version 0.10.0. As a temporary mitigation, restrict the use of the ` validate urls()` function.

**Name of the Vulnerable Software and Affected Versions** alioshr memory-bank-mcp versions 0.2.1 through 3.1 **Description** A path traversal issue exists within the `list-project-files-validation-factory.ts` file. This occurs when the `projectName` argument is manipulated, allowing an attacker with local access to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** makafeli n8n-workflow-builder versions prior to 0.11.1 **Description** A path traversal issue exists within the `update node from file` component in the `build/server.cjs` file. This occurs when the `filePath` argument is manipulated, allowing a local attacker to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict local access to the system to minimize the risk of exploitation.