This vulnerability exists in the processGenerateRequest function of the mcp_servers/mermaid/index.ts file within the generate_mermaid_markdown component of automateyournetwork MCPyATS up to version 0.1.4. By manipulating the folder/name argument, a local attacker can perform path traversal, potentially accessing files outside the intended directory. The attack vector is local with low attack complexity and requires low privileges but no user interaction. The vulnerability has limited impact on confidentiality, integrity, and availability.

The vulnerability allows a local attacker to traverse directories by manipulating input parameters, which may lead to unauthorized access to files outside the intended scope. However, the impact is limited due to the requirement for local access and low overall severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should restrict local access to trusted users only and monitor for updates from the vendor regarding a fix.