CVE-2026-19281

Name of the Vulnerable Software and Affected Versions adolfosalasgomez3011 slidev-builder-mcp version 2.1.0

Description A command injection flaw exists in the generateAssets Tool within the generateChart() function located in the src/tools/generateAssets.ts file. This issue occurs when the outputDir argument is manipulated, allowing an attacker with local access to execute arbitrary commands.

Recommendations As a temporary workaround, avoid using the outputDir argument in the generateChart() function until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.