CVE-2026-15522

Name of the Vulnerable Software and Affected Versions tugcantopaloglu godot-mcp version 2.0.0

Description A path traversal issue exists in the run project component within the validatePath() function of the build/index.js file. This occurs when the projectPath argument is manipulated, allowing a local attacker to access files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly validated.

Recommendations Upgrade to version 3.0.0. As a temporary mitigation, restrict access to the validatePath() function within the run project component.