The vulnerability exists in the is_safe_path function of the MCP File Handler component in 54yyyu code-mcp up to commit 4cfc4643541a110c906d93635b391bf7e357f4a8. It allows remote attackers to perform path traversal attacks by manipulating file paths, potentially leading to unauthorized file access. The project employs rolling releases, and no official patch or remediation has been published. The issue was reported early but remains unaddressed by the vendor. Exploit details have been publicly disclosed, though no known exploits in the wild have been confirmed.

Successful exploitation of this vulnerability could allow an attacker to access files outside the intended directory structure on the affected system remotely. This could lead to unauthorized disclosure of sensitive information or other impacts depending on the files accessed. The CVSS score of 6.9 indicates a medium severity impact with network attack vector and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor the project repository or vendor communications for updates. Until a fix is released, consider restricting network access to the affected component and applying additional access controls to limit exposure.