CVE-2026-19323

Name of the Vulnerable Software and Affected Versions azer react-analyzer-mcp versions up to 335f2a3585f265e2e88352b59b10d3b478d678b0

Description A path traversal flaw exists in the analyze-projec component within the generateProjectDocs() function located in the src/index.ts file. This issue occurs when the projectName argument is manipulated, allowing an attacker with local access to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly validated.

Recommendations As a temporary workaround, restrict the use of the projectName argument in the generateProjectDocs() function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.