CVE-2026-15749

Name of the Vulnerable Software and Affected Versions mastergo-design mastergo-magic-mcp versions prior to 0.2.1

Description A path traversal issue exists in the mcp C2d component within the execute() function of the src/tools/get-c2d.ts file. A local attacker can manipulate the filePath argument to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly validated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the execute() function in the src/tools/get-c2d.ts file or avoid using the filePath argument until a patch is available.