Threats affecting pkg:github/0215andrewfeng/ACE-MCP

CVE-2026-94046 is a path traversal vulnerability in the 0215AndrewFeng ACE-MCP product up to version 4.10.8. It affects the get_file_snippet function in the getFileSnippet.ts file of the MCP Tool component. The vulnerability arises from improper validation of the projectRootPath and filePath arguments, allowing an attacker to access files outside the intended directory. The vulnerability can be exploited remotely, and exploit code has been publicly disclosed. The vendor has been informed but has not yet responded or issued a fix.