Vulnerabilities CVE-2026-19328

CVE-2026-19328

Medium

Open

TLP:CLEAR

aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed locally. Upgrading to version 0.1.1 is recommended to address this issue. The identifier of the patch is 855b46739e0f6e8388f17f9d0066ac4298a3965d. Upgrading the affected component is recommended.

Details

CVSS Score: 4.8
EPSS Score ⓘ: 0.14%

3.6th percentile
CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Confidence: 90%
Published: Aug 9, 2026
Last Modified: Aug 9, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.