CVE-2026-86541: knowns before 0.30.0 Path Traversal via code.replace MCP action
knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious content to sensitive files like shell startup scripts or SSH configuration files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
code.replace MCP actionto a version that resolves this vulnerability.Fixed in 0.30.0
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
Deployments running knowns versions earlier than 0.30.0 should be treated as affected.
What does an attacker need to exploit this issue?
An attacker needs to be able to supply input to the code.replace MCP action, including an absolute path or a relative path containing directory-traversal sequences and malicious file content.