Threats affecting pkg:npm/debugmcp/mcp-debugger

CVE-2026-9467 is a path traversal vulnerability in the debugmcp mcp-debugger product up to version 0.20.0. It affects the handleGetSourceContext function in the src/server.ts file. This vulnerability can be exploited remotely without user interaction and requires low privileges. The exploit code is publicly available, and the vendor has not responded to disclosure attempts. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available.