CVE-2026-19038: MonomythDevelopment la-forge-mcp screenshot_element Tool index.ts screenshotElement path traversal
A security vulnerability has been detected in MonomythDevelopment la-forge-mcp 1.0.0. This issue affects the function screenshotElement of the file src/index.ts of the component screenshotelement Tool. Such manipulation of the argument outputname leads to path traversal. The attack can be executed remotely. Upgrading to version 1.1.1 is capable of addressing this issue. The name of the patch is 1102172c9adec4a619e241efd6bfb74f5b1f4332. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MonomythDevelopment la-forge-mcpto a version that resolves this vulnerability.Fixed in 1.1.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 1102172c9adec4a619e241efd6bfb74f5b1f4332 - Configuration
Apply the vendor patch for function screenshotElement in src/index.ts to prevent path traversal via the argument output_name.
la-forge-mcp (screenshot_element Tool) src/index.ts / screenshotElement output_name path handling = N/A
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19038?
The severity of CVE-2026-19038 is classified as medium with a score of 6.3.
How do I fix CVE-2026-19038?
To fix CVE-2026-19038, ensure proper sanitization and validation of the output_name argument to prevent path traversal attacks.
What is the impact of CVE-2026-19038?
The impact of CVE-2026-19038 includes potential unauthorized file access due to path traversal vulnerabilities.
Which software is affected by CVE-2026-19038?
CVE-2026-19038 affects MonomythDevelopment la-forge-mcp version 1.0.0, specifically the screenshot_element Tool.
What kind of vulnerability is CVE-2026-19038?
CVE-2026-19038 is a path traversal vulnerability identified in the screenshotElement function of the la-forge-mcp tool.