Search
Find a vulnerability
Search criteria
2 vulnerabilities by aktsmm
CVE-2026-19328 (GCVE-0-2026-19328)
Vulnerability from nvd – Published: 2026-08-09 02:45 – Updated: 2026-08-12 20:55 X_Open Source
VLAI
EPSS
VEX
Title
aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal
Summary
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed locally. Upgrading to version 0.1.1 is recommended to address this issue. The identifier of the patch is 855b46739e0f6e8388f17f9d0066ac4298a3965d. Upgrading the affected component is recommended.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 20:47 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/387162 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/387162/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19328 | third-party-advisory |
| https://vuldb.com/submit/865245 | third-party-advisory |
| https://github.com/aktsmm/skill-ninja-mcp-server/… | issue-tracking |
| https://github.com/aktsmm/skill-ninja-mcp-server/… | patch |
| https://github.com/aktsmm/skill-ninja-mcp-server/… | patch |
| https://github.com/aktsmm/skill-ninja-mcp-server/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| aktsmm | skill-ninja-mcp-server |
Affected:
0.1.0
Unaffected: 0.1.1 cpe:2.3:a:aktsmm:skill-ninja-mcp-server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19328",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T20:47:31.968256Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T20:55:47.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:aktsmm:skill-ninja-mcp-server:*:*:*:*:*:*:*:*"
],
"product": "skill-ninja-mcp-server",
"vendor": "aktsmm",
"versions": [
{
"status": "affected",
"version": "0.1.0"
},
{
"status": "unaffected",
"version": "0.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gongyanyu03 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed locally. Upgrading to version 0.1.1 is recommended to address this issue. The identifier of the patch is 855b46739e0f6e8388f17f9d0066ac4298a3965d. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T02:45:10.898Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387162 | aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387162"
},
{
"name": "VDB-387162 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387162/cti"
},
{
"name": "CVE-2026-19328 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19328"
},
{
"name": "Submit #865245 | aktsmm skill-ninja-mcp-server unknown Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/865245"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/aktsmm/skill-ninja-mcp-server/issues/2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/aktsmm/skill-ninja-mcp-server/commit/855b46739e0f6e8388f17f9d0066ac4298a3965d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/aktsmm/skill-ninja-mcp-server/releases/tag/v0.1.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/aktsmm/skill-ninja-mcp-server/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-08T11:35:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19328",
"datePublished": "2026-08-09T02:45:10.898Z",
"dateReserved": "2026-08-08T09:29:52.930Z",
"dateUpdated": "2026-08-12T20:55:47.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19328 (GCVE-0-2026-19328)
Vulnerability from cvelistv5 – Published: 2026-08-09 02:45 – Updated: 2026-08-12 20:55 X_Open Source
VLAI
EPSS
VEX
Title
aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal
Summary
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed locally. Upgrading to version 0.1.1 is recommended to address this issue. The identifier of the patch is 855b46739e0f6e8388f17f9d0066ac4298a3965d. Upgrading the affected component is recommended.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 20:47 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/387162 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/387162/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19328 | third-party-advisory |
| https://vuldb.com/submit/865245 | third-party-advisory |
| https://github.com/aktsmm/skill-ninja-mcp-server/… | issue-tracking |
| https://github.com/aktsmm/skill-ninja-mcp-server/… | patch |
| https://github.com/aktsmm/skill-ninja-mcp-server/… | patch |
| https://github.com/aktsmm/skill-ninja-mcp-server/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| aktsmm | skill-ninja-mcp-server |
Affected:
0.1.0
Unaffected: 0.1.1 cpe:2.3:a:aktsmm:skill-ninja-mcp-server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19328",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T20:47:31.968256Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T20:55:47.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:aktsmm:skill-ninja-mcp-server:*:*:*:*:*:*:*:*"
],
"product": "skill-ninja-mcp-server",
"vendor": "aktsmm",
"versions": [
{
"status": "affected",
"version": "0.1.0"
},
{
"status": "unaffected",
"version": "0.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gongyanyu03 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed locally. Upgrading to version 0.1.1 is recommended to address this issue. The identifier of the patch is 855b46739e0f6e8388f17f9d0066ac4298a3965d. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T02:45:10.898Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387162 | aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387162"
},
{
"name": "VDB-387162 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387162/cti"
},
{
"name": "CVE-2026-19328 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19328"
},
{
"name": "Submit #865245 | aktsmm skill-ninja-mcp-server unknown Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/865245"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/aktsmm/skill-ninja-mcp-server/issues/2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/aktsmm/skill-ninja-mcp-server/commit/855b46739e0f6e8388f17f9d0066ac4298a3965d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/aktsmm/skill-ninja-mcp-server/releases/tag/v0.1.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/aktsmm/skill-ninja-mcp-server/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-08T11:35:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19328",
"datePublished": "2026-08-09T02:45:10.898Z",
"dateReserved": "2026-08-08T09:29:52.930Z",
"dateUpdated": "2026-08-12T20:55:47.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}