This vulnerability involves a path traversal issue in the HelloGGX shadcn-vue-mcp project, specifically in the fs.promises.readFile function within src/server/callback-server.ts. An attacker with local access can manipulate the filepath argument to read arbitrary files outside the intended directory. Due to the rolling release model of the project, no explicit version ranges are specified. The vendor has been notified but has not provided a response or patch at this time.

An attacker with local access and low privileges can exploit this vulnerability to read arbitrary files on the system by manipulating the filepath argument. This could lead to unauthorized disclosure of sensitive information. The vulnerability does not allow remote exploitation or privilege escalation based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for updates from the vendor. Avoid running the affected component in untrusted environments until a fix is available.