Threats tagged 'ghsa-g57q-682f-hr5f'

CVE-2026-19371 is a path traversal vulnerability in the copyFileSync function of the comfy_upload_image component in Nikolaibibo claude-comfyui-mcp 1.0.0. The flaw allows local attackers with limited privileges to manipulate the image_path argument, potentially leading to unauthorized file access or modification. The project has been informed but has not yet responded or issued a fix. The vulnerability has a CVSS score of 5.3, indicating low severity.