This vulnerability in bartekke8it56w2 new-mcp 0.1.0 involves path traversal caused by improper handling of sessionCommand/sessionPath arguments in the geminithinking component's index.ts file. The affected functions are fs.writeFileSync, fs.existsSync, and fs.readFileSync. Exploitation requires local access. The issue was reported early to the project, but no remediation or patch has been provided to date.

An attacker with local access can exploit this vulnerability to perform path traversal, potentially reading or writing files outside the intended directory scope. This could lead to unauthorized access or modification of files on the system where the software is running. The impact is limited by the requirement for local access and the medium CVSS score reflects this.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should restrict local access to trusted users only and monitor for suspicious activity involving file operations related to sessionCommand/sessionPath until an official fix is released.