This vulnerability affects lamaalrajih kicad-mcp up to version 3.3.1, specifically in the handling of project_path and schematic_path arguments within the path_validator.py utility. Improper processing leads to a failure of protection mechanisms, potentially allowing an attacker with local access and low privileges to bypass intended restrictions. The vulnerability has a CVSS 4.8 (medium) score, indicating limited impact and exploitability. Although the issue was responsibly disclosed, the vendor has not issued a patch or official remediation. Public exploit code exists, increasing the risk of local exploitation.

An attacker with local access and low privileges can manipulate certain path arguments to bypass protection mechanisms in the affected software. This could lead to unauthorized actions or access within the local environment where kicad-mcp is installed. There is no indication of remote exploitation or privilege escalation beyond the local user context. No known exploits are currently observed in the wild beyond the public exploit availability.

No official patch or remediation is currently available from the vendor. Users should restrict local access to trusted individuals only and monitor for suspicious activity related to manipulation of project_path or schematic_path arguments. Since the exploit is public, applying any future vendor updates promptly is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.