Threats affecting pkg:npm/handwriting-ocr/handwriting-ocr-mcp-server

CVE-2026-19372 is a path traversal vulnerability in Handwriting-OCR handwriting-ocr-mcp-server version 0.1.0. The flaw exists in the fs.readFileSync function within the src/index.ts file's upload_document component. Exploitation requires local access and manipulation of the File argument to traverse directories. The project has been informed but has not yet issued a response or fix. The vulnerability has a medium severity rating with a CVSS score of 4.8.