MCPA-2026-0086
lowpath-traversalCVSS 5.3
react-analyzer-mcp analyze-project path traversal (CVE-2026-19323)
react-analyzer-mcp (npm) up to 1.0.0: the analyze-project MCP tool passes the caller-controlled projectName argument into path.join(PROJECT_ROOT, subFolder) in src/index.ts without normalization or containment checks, so generateProjectDocs/listReactFiles can escape the configured project root and recursively enumerate and read arbitrary .jsx/.tsx files from attacker-selected directories on the host. The project was informed through a public issue but has not responded; the repository uses rolling releases and no fixed release exists, so the range is recorded as last_affected 1.0.0 (the only npm release) per the public advisory.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | react-analyzer-mcp | >= 0, <= 1.0.0 |
Identifiers
CVE-2026-19323GHSA-g23h-49jw-gw6qCWE-22
References
- advisory https://github.com/advisories/GHSA-g23h-49jw-gw6q
- web https://nvd.nist.gov/vuln/detail/CVE-2026-19323
- web https://github.com/azer/react-analyzer-mcp/issues/3
Timeline
- Published: 2026-08-09