CVE-2026-19279

Name of the Vulnerable Software and Affected Versions MIMICLab mcp-pdf-vision version 1.1.0

Description Command injection is possible through the manipulation of the pdfPath or sessionId arguments within the load pdf() function located in the src/index.ts file. This issue allows an attacker to execute arbitrary commands, although the attack is limited to a local environment.

Recommendations As a temporary workaround, restrict the use of the load pdf() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.