This vulnerability in bartekke8it56w2 new-mcp 0.1.0 involves path traversal due to manipulation of the sessionCommand/sessionPath arguments in the geminithinking component's index.ts file. The affected functions are fs.writeFileSync, fs.existsSync, and fs.readFileSync. Exploitation requires local access and can lead to unauthorized file system access or modification. The issue was reported early to the project, but no response or remediation has been provided to date.

Successful exploitation allows a local attacker to perform path traversal attacks, potentially leading to unauthorized reading, writing, or existence checking of files outside intended directories. This impacts confidentiality, integrity, and availability at a low severity level as per the CVSS 3.1 score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should restrict local access to trusted users only and monitor for updates from the project for an official fix.