MCPA-2026-0088
spec-workflow-mcp approvals tool categoryName path traversal (CVE-2026-19336)
@pimzino/spec-workflow-mcp (npm): the approvals MCP tool passes the caller-controlled categoryName argument into ApprovalStorage.createApproval() (src/tools/approvals.ts / src/dashboard/approval-storage.ts) without validation — filePath is checked for absolute paths and '..', but categoryName is joined directly under the approvals directory before fs.writeFile(), so a traversal value like '..\..\..\outside' creates directories and writes approval JSON files outside the intended .spec-workflow/approvals tree (public PoC in the upstream issue). Fixed on main by PR #222 (merge commit 1ef0112ba8eda2e1ecc2666c3ad8d1f91393d886, validateSimplePathSegment/safeJoin guards, repo version 2.2.7), but no fixed build is published to npm (latest is 2.2.5), so this is recorded as last_affected 2.2.5.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | @pimzino/spec-workflow-mcp | >= 0, <= 2.2.5 |
Identifiers
CVE-2026-19336GHSA-xgwr-j735-3wg4CWE-22
References
- advisory https://github.com/advisories/GHSA-xgwr-j735-3wg4
- web https://nvd.nist.gov/vuln/detail/CVE-2026-19336
- web https://github.com/Pimzino/spec-workflow-mcp/issues/220
- fix https://github.com/Pimzino/spec-workflow-mcp/pull/222
Timeline
- Published: 2026-08-09