MCPA-2026-0092
lowpath-traversalCVSS 5.3
LudusMCP insert_creds_range_config path traversal (CVE-2026-19366)
LudusMCP (npm: ludus-mcp) up to and including 1.0.24 is vulnerable to path traversal: src/tools/insertCredsRangeConfig.ts (component insert_creds_range_config) resolves the configPath and outputPath arguments against the range-config-templates directory with path.join/path.resolve and no traversal sanitization, so a poisoned tool call can read from and write credential-bearing config output to files outside the intended directory (verified by unpacking the published ludus-mcp@1.0.24 tarball). The maintainer was notified via a public issue but no fixed release exists as of 2026-08-09, so this is recorded as last_affected 1.0.24.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | ludus-mcp | >= 0, <= 1.0.24 |
Identifiers
CVE-2026-19366GHSA-hj87-3g9g-3832CWE-22
References
- advisory https://github.com/advisories/GHSA-hj87-3g9g-3832
- web https://nvd.nist.gov/vuln/detail/CVE-2026-19366
- web https://github.com/NocteDefensor/LudusMCP
Timeline
- Published: 2026-08-09