Threats affecting pkg:gem/gemsuite-mcp

CVE-2026-19368 is a path traversal vulnerability in PV-Bhat gemsuite-mcp version 1.0.0. It affects an unspecified functionality in the file src/handlers/unified-gemini.ts related to components gemini_search, gemini_reason, gemini_process, and gemini_analyze. The vulnerability arises from manipulation of the file_path or file_paths argument, allowing local attackers to perform path traversal. The vendor has not yet responded or issued a fix.