CVE-2026-19038

Name of the Vulnerable Software and Affected Versions MonomythDevelopment la-forge-mcp versions prior to 1.1.1

Description A path traversal issue exists in the screenshotElement() function within the src/index.ts file of the screenshot element Tool. This flaw allows a remote attacker to manipulate the output name argument to access or write files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly validated.

Recommendations Upgrade to version 1.1.1. As a temporary mitigation, restrict the use of the output name argument in the screenshotElement() function.