This vulnerability exists in the generateProjectDocs function of the analyze-projec component in azer react-analyzer-mcp up to commit 335f2a3585f265e2e88352b59b10d3b478d678b0. By manipulating the projectName argument, an attacker with local access can perform a path traversal attack. Due to the rolling release nature of the product, no explicit versioning information is available for affected or fixed releases. The issue was reported early to the project but remains unaddressed. The CVSS 4.0 vector indicates low attack complexity and privileges required, no user interaction, and partial impacts on confidentiality, integrity, and availability.

An attacker with local access can exploit this vulnerability to perform path traversal, potentially accessing or modifying files outside the intended directory scope. This can lead to partial compromise of confidentiality, integrity, and availability of the system where the software is deployed. The impact is limited by the requirement for local access and the medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should restrict local access to trusted users only and monitor for any suspicious activity related to the generateProjectDocs function. Avoid running the vulnerable component in untrusted environments until a fix is available.