CVE-2026-19328
Received Received - Intake

Path Traversal in skill-ninja-mcp-server

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed locally. Upgrading to version 0.1.1 is recommended to address this issue. The identifier of the patch is 855b46739e0f6e8388f17f9d0066ac4298a3965d. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19328
EUVD
EUVD-2026-54859

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
aktsmm skill-ninja-mcp-server 0.1.0
aktsmm skill-ninja-mcp-server 0.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the skill-ninja-mcp-server 0.1.0. It occurs in functions like getInstalledSkills, installSkill, updateAgentsMd, and uninstallSkill within src/installer.ts. The attack involves manipulating the workspacePath argument to access unintended directories on the local system. The vulnerability requires local access to exploit.

Detection Guidance

Check if the vulnerable version 0.1.0 of skill-ninja-mcp-server is installed by running: npm list skill-ninja-mcp-server or npm list -g skill-ninja-mcp-server. Verify the installed version against the patched version 0.1.1.

Impact Analysis

An attacker could read, write, or delete files outside intended directories by manipulating workspacePath. This may lead to data theft, corruption, or system compromise. Since it requires local access, the risk is higher for shared or multi-user systems where untrusted users have shell access.

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or altered due to the flaw.

Mitigation Strategies

Upgrade to version 0.1.1 or later using npm update skill-ninja-mcp-server or npm install -g skill-ninja-mcp-server@latest. Ensure workspacePath inputs are restricted to trusted directories and validate paths before filesystem operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19328. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart