The vulnerability identified as CVE-2026-19338 affects automateyournetwork MCPyATS versions up to 0.1.4. It resides in the processGenerateRequest function within the mcp_servers/mermaid/index.ts file, specifically in the generate_mermaid_markdown component. The flaw is a path traversal (CWE-22) caused by improper handling of the folder/name argument, allowing an attacker with local access to traverse directories and potentially access unauthorized files. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, indicating local attack vector, low complexity, low privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

An attacker with local access can exploit this vulnerability to perform path traversal, potentially reading or modifying files outside the intended directory. The impact on confidentiality, integrity, and availability is rated low. There is no indication of remote exploitation or elevated privileges required beyond local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious local activity related to the affected component.