CVE-2026-15526

Name of the Vulnerable Software and Affected Versions augmnt augments-mcp-server version 7.1.0

Description A path traversal flaw exists in the scanProjectDeps() function within the src/tools/v4/scan-project-deps.ts file of the scan project deps component. This issue occurs when the packageJsonPath argument is manipulated, allowing a local attacker to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

Recommendations As a temporary workaround, restrict the use of the packageJsonPath argument in the scanProjectDeps() function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.