CVE-2026-19323: azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path traversal
A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path traversal. The attack is only possible with local access. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19323?
CVE-2026-19323 has a medium severity rating of 5.3.
What type of vulnerability is CVE-2026-19323?
CVE-2026-19323 is classified as a path traversal vulnerability.
How do I fix CVE-2026-19323?
To fix CVE-2026-19323, update the azer/react-analyzer-mcp package to a version after commit 335f2a3585f265e2e88352b59b10d3b478d678b0.
What is the impact of CVE-2026-19323?
The impact of CVE-2026-19323 can allow an attacker to manipulate projectName, leading to unauthorized access to files on the system.
Who is affected by CVE-2026-19323?
Users of the azer/react-analyzer-mcp component version up to 335f2a3585f265e2e88352b59b10d3b478d678b0 are affected by CVE-2026-19323.