This vulnerability involves a path traversal issue in the HelloGGX shadcn-vue-mcp project, specifically in the fs.promises.readFile function within src/server/callback-server.ts. An attacker with local access and limited privileges can manipulate the filepath argument to access files outside the intended directory. Due to the rolling release strategy of the product, no precise version ranges for affected or fixed releases are available. The vendor has been informed but has not issued a response or patch. The CVSS 4.0 vector indicates local attack vector, low complexity, no user interaction, and partial confidentiality impact.

An attacker with local access and limited privileges can exploit this vulnerability to read arbitrary files on the system, potentially exposing sensitive information. The impact is limited to confidentiality and requires local execution, reducing the attack surface. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should restrict local access to trusted users only and monitor for updates from the vendor. Avoid running the affected component with unnecessary privileges until a fix is released.