CVE-2026-19370

Name of the Vulnerable Software and Affected Versions bartekke8it56w2 new-mcp version 0.1.0

Description A path traversal issue exists within the geminithinking component in the file index.ts. The flaw occurs when the sessionCommand or sessionPath arguments are manipulated, affecting the fs.writeFileSync(), fs.existsSync(), and fs.readFileSync() functions. Exploitation of this issue requires local access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.