Threats tagged 'ghsa-w5g7-c885-pm69'

CVE-2026-19370 is a path traversal vulnerability in bartekke8it56w2 new-mcp 0.1.0 affecting the geminithinking component. The flaw arises from improper handling of arguments in fs.writeFileSync, fs.existsSync, and fs.readFileSync functions in index.ts, allowing local attackers to manipulate file paths. The vulnerability requires local access and impacts confidentiality, integrity, and availability at a low severity level. The project has been informed but has not yet responded or issued a patch.