CVE-2026-19324

Name of the Vulnerable Software and Affected Versions HelloGGX shadcn-vue-mcp versions up to e170e277b94235cde627803277fc8c41103a4d38

Description A path traversal issue exists in the fs.promises.readFile() function within the src/server/callback-server.ts file. This occurs when the filepath argument is manipulated, allowing for unauthorized file access. Exploitation of this issue is restricted to local execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.