CVE-2026-19328: aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed locally. Upgrading to version 0.1.1 is recommended to address this issue. The identifier of the patch is 855b46739e0f6e8388f17f9d0066ac4298a3965d. Upgrading the affected component is recommended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aktsmm/skill-ninja-mcp-serverto a version that resolves this vulnerability.Fixed in 0.1.1Patch 855b46739e0f6e8388f17f9d0066ac4298a3965d
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19328?
CVE-2026-19328 has a medium severity rating of 5.3.
What is the impact of CVE-2026-19328?
CVE-2026-19328 allows for path traversal through the manipulation of the argument workspacePath.
How do I fix CVE-2026-19328?
To fix CVE-2026-19328, ensure that input is properly validated and sanitize the workspacePath argument.
What software is affected by CVE-2026-19328?
CVE-2026-19328 affects aktsmm skill-ninja-mcp-server version 0.1.0.
Is remote exploitation possible with CVE-2026-19328?
No, CVE-2026-19328 requires the attack to be performed locally.