Threats affecting pkg:pypi/geldata/gel-mcp

CVE-2026-7403 is a path traversal vulnerability in geldata gel-mcp version 0.1.0. It affects the list_rules/fetch_rule function in src/gel_mcp/server.py, where manipulation of the rule_name argument allows an attacker to perform path traversal remotely. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). The project has been informed but has not yet responded or issued a fix. Exploit code is publicly available, but no confirmed exploitation in the wild has been reported.