The vulnerability exists in the is_safe_path function of the MCP File Handler component in 54yyyu code-mcp up to commit 4cfc4643541a110c906d93635b391bf7e357f4a8. It allows remote attackers to perform path traversal attacks by manipulating file paths, potentially leading to unauthorized file access. The project was notified early but has not responded or provided a patch. Due to the rolling release model, affected and fixed version details are not available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to limited confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow an attacker to access files outside the intended directory structure remotely, potentially exposing sensitive information or enabling further attacks. The impact is rated medium based on the CVSS score of 6.9, reflecting limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor the project repository or issue tracker for updates. In the meantime, consider implementing network-level controls to restrict access to the affected component and validate or sanitize file path inputs where possible.