Threat Intelligence Database

CVE-2026-15751 is a path traversal vulnerability in the mastergo-design mastergo-magic-mcp component, specifically in the execute function of mastergo/component-workflow.md related to mcp__getComponentGenerator. It affects versions 0.1 and 0.2.0. The vulnerability requires local access to exploit and involves manipulation of the rootPath argument. The issue has been publicly disclosed, but no official fix or vendor response has been provided yet.

A server-side request forgery (SSRF) vulnerability exists in mastergo-design mastergo-magic-mcp versions 0.1 and 0.2.0. The issue is in the z.string function within src/tools/get-component-link.ts, specifically in the mcp__getComponentLink component. Manipulating the url argument can lead to SSRF attacks, which may be initiated remotely. The vulnerability has a medium severity rating with a CVSS score of 5.3. The project has been informed but has not yet responded or issued a fix. No patches or official remediations are currently available.

A path traversal vulnerability exists in mastergo-design mastergo-magic-mcp versions 0.1 and 0.2.0. The flaw is in the execute function of src/tools/get-c2d.ts within the mcp__C2d component, where manipulation of the filePath argument allows local attackers to perform path traversal. The vulnerability requires local access and has a medium severity score of 4.8. The project has been informed but has not yet responded or issued a fix. Exploit code has been publicly released.