This vulnerability exists in the astralisone rive-mcp-server-core project within the importRiveFile Flow component, specifically in the file packages/mcp-server/src/tools/importRiveFile.ts. Manipulating the libraryId argument can lead to path traversal, enabling an attacker with local access to potentially access files outside the intended directory. The vulnerability requires local attack vector and low privileges. Due to the rolling release nature of the product, exact affected versions are not specified. The vendor has not yet responded or provided a fix.

An attacker with local access and low privileges can exploit this vulnerability to perform path traversal, potentially accessing or manipulating files outside the intended scope. The impact is limited by the requirement for local access and low privileges. There is no indication of remote exploitation or privilege escalation beyond the local user context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is currently available, users should restrict local access to trusted users only and monitor for updates from the vendor.