CVE-2026-19279: MIMICLab mcp-pdf-vision index.ts load_pdf command injection
A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function loadpdf of the file src/index.ts. Such manipulation of the argument pdfPath/sessionId leads to command injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19279?
CVE-2026-19279 has a medium severity rating of 5.3.
How do I fix CVE-2026-19279?
To fix CVE-2026-19279, ensure input validation and restrict the usage of the load_pdf function to prevent command injection.
What type of vulnerability is CVE-2026-19279?
CVE-2026-19279 is a command injection vulnerability.
What is affected by CVE-2026-19279?
CVE-2026-19279 affects the load_pdf function in the src/index.ts file of MIMICLab mcp-pdf-vision version 1.1.0.
Can CVE-2026-19279 be exploited remotely?
CVE-2026-19279 can only be exploited from a local environment.