Threats tagged 'ghsa-h65h-28xw-w79q'

A path traversal vulnerability exists in huangjunsen0406 xiaozhi-mcphub up to version 1.0.3 in the src/controllers/dxtController.ts file. The flaw is caused by improper handling of the argument manifest.name, allowing remote attackers to manipulate file paths. Public exploit code is available, but the project has not yet responded or issued a fix. The vulnerability has a medium severity rating with a CVSS score of 6.3.