Threats affecting pkg:npm/@agiflowai/aicode-toolkit

CVE-2026-7237 is a path traversal vulnerability in AgiFlow scaffold-mcp versions up to 1.0.27. The issue arises from improper handling of the file_path argument in the write-to-file tool component, allowing remote attackers to manipulate file paths. Exploitation can lead to unauthorized file access or modification. A public exploit exists. Upgrading to version 1.1.0 resolves the vulnerability.