CVE-2026-19366

medium

Description

A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component insert_creds_range_config. Executing a manipulation of the argument configPath/outputPath can lead to path traversal. The attack is restricted to local execution. The project was informed of the problem early through an issue report but has not responded yet.

References

https://vuldb.com/vuln/387233/cti

https://vuldb.com/vuln/387233

https://vuldb.com/submit/866262

https://vuldb.com/cve/CVE-2026-19366

https://github.com/NocteDefensor/LudusMCP/issues/5

https://github.com/NocteDefensor/LudusMCP/

Details

Source: Mitre, NVD

Published: 2026-08-09

Updated: 2026-08-09

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 5.3

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Severity: Medium

CVSS v4

Base Score: 4.8

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Severity: Medium