Search
Find a vulnerability
Search criteria
2 vulnerabilities found for augments-mcp-server by augmnt
CVE-2026-15526 (GCVE-0-2026-15526)
Vulnerability from nvd – Published: 2026-07-13 02:45 – Updated: 2026-07-13 15:52
VLAI
EPSS
VEX
Title
augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversal
Summary
A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file src/tools/v4/scan-project-deps.ts of the component scan_project_deps. Executing a manipulation of the argument packageJsonPath can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Path Traversal
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/377855 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/377855/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15526 | third-party-advisory |
| https://vuldb.com/submit/854529 | third-party-advisory |
| https://github.com/augmnt/augments-mcp-server/issues/8 | exploitissue-tracking |
| https://github.com/augmnt/augments-mcp-server/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| augmnt | augments-mcp-server |
Affected:
7.1.0
cpe:2.3:a:augmnt:augments-mcp-server:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15526",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T15:52:18.579057Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T15:52:24.189Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:augmnt:augments-mcp-server:*:*:*:*:*:*:*:*"
],
"modules": [
"scan_project_deps"
],
"product": "augments-mcp-server",
"vendor": "augmnt",
"versions": [
{
"status": "affected",
"version": "7.1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mcfly_Zhang (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file src/tools/v4/scan-project-deps.ts of the component scan_project_deps. Executing a manipulation of the argument packageJsonPath can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T02:45:08.736Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-377855 | augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/377855"
},
{
"name": "VDB-377855 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/377855/cti"
},
{
"name": "CVE-2026-15526 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15526"
},
{
"name": "Submit #854529 | augmnt augments-mcp-server 7.1.0 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/854529"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/augmnt/augments-mcp-server/issues/8"
},
{
"tags": [
"product"
],
"url": "https://github.com/augmnt/augments-mcp-server/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-12T14:12:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15526",
"datePublished": "2026-07-13T02:45:08.736Z",
"dateReserved": "2026-07-12T12:07:55.086Z",
"dateUpdated": "2026-07-13T15:52:24.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15526 (GCVE-0-2026-15526)
Vulnerability from cvelistv5 – Published: 2026-07-13 02:45 – Updated: 2026-07-13 15:52
VLAI
EPSS
VEX
Title
augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversal
Summary
A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file src/tools/v4/scan-project-deps.ts of the component scan_project_deps. Executing a manipulation of the argument packageJsonPath can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Path Traversal
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/377855 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/377855/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15526 | third-party-advisory |
| https://vuldb.com/submit/854529 | third-party-advisory |
| https://github.com/augmnt/augments-mcp-server/issues/8 | exploitissue-tracking |
| https://github.com/augmnt/augments-mcp-server/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| augmnt | augments-mcp-server |
Affected:
7.1.0
cpe:2.3:a:augmnt:augments-mcp-server:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15526",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T15:52:18.579057Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T15:52:24.189Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:augmnt:augments-mcp-server:*:*:*:*:*:*:*:*"
],
"modules": [
"scan_project_deps"
],
"product": "augments-mcp-server",
"vendor": "augmnt",
"versions": [
{
"status": "affected",
"version": "7.1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mcfly_Zhang (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file src/tools/v4/scan-project-deps.ts of the component scan_project_deps. Executing a manipulation of the argument packageJsonPath can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T02:45:08.736Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-377855 | augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/377855"
},
{
"name": "VDB-377855 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/377855/cti"
},
{
"name": "CVE-2026-15526 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15526"
},
{
"name": "Submit #854529 | augmnt augments-mcp-server 7.1.0 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/854529"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/augmnt/augments-mcp-server/issues/8"
},
{
"tags": [
"product"
],
"url": "https://github.com/augmnt/augments-mcp-server/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-12T14:12:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15526",
"datePublished": "2026-07-13T02:45:08.736Z",
"dateReserved": "2026-07-12T12:07:55.086Z",
"dateUpdated": "2026-07-13T15:52:24.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}