This vulnerability in astralisone rive-mcp-server-core up to commit db1d0cc4cd52589116360428b7504fd0ca748b3e allows local attackers to perform path traversal by manipulating the libraryId argument in the importRiveFile.ts source file. The flaw is categorized as CWE-22 (Path Traversal). The attack requires local access and low privileges. The product follows a rolling release model, so no fixed versions or patches have been identified or published. The vendor has not responded to the issue report. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, reflecting low attack complexity and partial impact on confidentiality, integrity, and availability.

An attacker with local access and low privileges can exploit this vulnerability to perform path traversal, potentially accessing or modifying files outside intended directories. This could lead to limited confidentiality, integrity, and availability impacts. Since the attack requires local access, remote exploitation is not possible. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should restrict local access to trusted users only and monitor for suspicious local activity related to the importRiveFile component. Avoid running the affected software in untrusted environments until a fix is released.