Search
Find a vulnerability
Search criteria
2 vulnerabilities found for shadcn-vue-mcp by HelloGGX
CVE-2026-19324 (GCVE-0-2026-19324)
Vulnerability from nvd – Published: 2026-08-09 01:30 – Updated: 2026-08-10 13:38
VLAI
EPSS
VEX
Title
HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal
Summary
A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restricted to local execution. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 13:38 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/387158 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/387158/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19324 | third-party-advisory |
| https://vuldb.com/submit/865241 | third-party-advisory |
| https://github.com/HelloGGX/shadcn-vue-mcp/issues/14 | issue-tracking |
| https://github.com/HelloGGX/shadcn-vue-mcp/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HelloGGX | shadcn-vue-mcp |
Affected:
e170e277b94235cde627803277fc8c41103a4d38
cpe:2.3:a:helloggx:shadcn-vue-mcp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19324",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T13:38:49.269526Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T13:38:59.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:helloggx:shadcn-vue-mcp:*:*:*:*:*:*:*:*"
],
"product": "shadcn-vue-mcp",
"vendor": "HelloGGX",
"versions": [
{
"status": "affected",
"version": "e170e277b94235cde627803277fc8c41103a4d38"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gongyanyu03 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restricted to local execution. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T01:30:11.521Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387158 | HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387158"
},
{
"name": "VDB-387158 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387158/cti"
},
{
"name": "CVE-2026-19324 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19324"
},
{
"name": "Submit #865241 | HelloGGX shadcn-vue-mcp unknown Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/865241"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/HelloGGX/shadcn-vue-mcp/issues/14"
},
{
"tags": [
"product"
],
"url": "https://github.com/HelloGGX/shadcn-vue-mcp/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-08T11:13:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19324",
"datePublished": "2026-08-09T01:30:11.521Z",
"dateReserved": "2026-08-08T09:07:54.466Z",
"dateUpdated": "2026-08-10T13:38:59.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19324 (GCVE-0-2026-19324)
Vulnerability from cvelistv5 – Published: 2026-08-09 01:30 – Updated: 2026-08-10 13:38
VLAI
EPSS
VEX
Title
HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal
Summary
A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restricted to local execution. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 13:38 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/387158 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/387158/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19324 | third-party-advisory |
| https://vuldb.com/submit/865241 | third-party-advisory |
| https://github.com/HelloGGX/shadcn-vue-mcp/issues/14 | issue-tracking |
| https://github.com/HelloGGX/shadcn-vue-mcp/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HelloGGX | shadcn-vue-mcp |
Affected:
e170e277b94235cde627803277fc8c41103a4d38
cpe:2.3:a:helloggx:shadcn-vue-mcp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19324",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T13:38:49.269526Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T13:38:59.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:helloggx:shadcn-vue-mcp:*:*:*:*:*:*:*:*"
],
"product": "shadcn-vue-mcp",
"vendor": "HelloGGX",
"versions": [
{
"status": "affected",
"version": "e170e277b94235cde627803277fc8c41103a4d38"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gongyanyu03 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restricted to local execution. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T01:30:11.521Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387158 | HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387158"
},
{
"name": "VDB-387158 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387158/cti"
},
{
"name": "CVE-2026-19324 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19324"
},
{
"name": "Submit #865241 | HelloGGX shadcn-vue-mcp unknown Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/865241"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/HelloGGX/shadcn-vue-mcp/issues/14"
},
{
"tags": [
"product"
],
"url": "https://github.com/HelloGGX/shadcn-vue-mcp/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-08T11:13:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19324",
"datePublished": "2026-08-09T01:30:11.521Z",
"dateReserved": "2026-08-08T09:07:54.466Z",
"dateUpdated": "2026-08-10T13:38:59.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}