CVE-2026-19338

Name of the Vulnerable Software and Affected Versions automateyournetwork MCPyATS versions prior to 0.1.5

Description A path traversal issue exists in the generate mermaid markdown component within the processGenerateRequest() function located in the mcp servers/mermaid/index.ts file. A local attacker can manipulate the folder/name argument to access files or directories outside the intended scope. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as filenames and file paths.

Recommendations Update automateyournetwork MCPyATS to version 0.1.5 or later. As a temporary mitigation, restrict local access to the processGenerateRequest() function.