CVE-2026-19281: Slidev-Builder-MCP RCE Vulnerability

CVE-2026-19281 Overview

CVE-2026-19281 is a command injection vulnerability in adolfosalasgomez3011 slidev-builder-mcp version 2.1.0. The flaw resides in the generateChart function within src/tools/generateAssets.ts, part of the generateAssets Tool component. An attacker with local access can manipulate the outputDir argument to inject arbitrary commands. The vulnerability is tracked under CWE-74 (Improper Neutralization of Special Elements in Output). According to VulDB, the project maintainers were notified via an issue report but have not responded. The EPSS score is 0.624% with a percentile of 46.883.

Critical Impact
Local attackers can execute arbitrary commands by manipulating the outputDir parameter passed to the generateChart function, resulting in unauthorized command execution within the process context.

Affected Products

adolfosalasgomez3011/slidev-builder-mcp version 2.1.0
Component: generateAssets Tool
File: src/tools/generateAssets.ts

Discovery Timeline

2026-08-08 - CVE-2026-19281 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19281

Vulnerability Analysis

The vulnerability exists in the generateChart function of src/tools/generateAssets.ts within the slidev-builder-mcp project. This function accepts an outputDir argument that is used in shell command construction without proper sanitization. When an attacker supplies specially crafted input containing shell metacharacters, those characters are interpreted by the underlying shell rather than treated as literal path data. The result is command injection within the context of the process running the tool.

The issue is classified under CWE-74, covering improper neutralization of special elements in output used by a downstream component. Exploitation requires local access and low-level privileges. No authentication bypass is required beyond the initial local foothold.

Root Cause

The root cause is missing input validation and sanitization on the outputDir argument in generateChart. User-controlled input flows directly into a shell command execution path. The absence of parameterized execution or an allow-list for permitted directory characters permits shell metacharacters such as ;, |, &, and backticks to alter command semantics.

Attack Vector

The attack requires local access to a system where slidev-builder-mcp 2.1.0 is installed. An attacker invokes the generateAssets tool and supplies an outputDir value that includes shell metacharacters followed by an arbitrary command. When the vulnerable code path constructs and executes the shell command, the injected payload runs with the privileges of the tool's process. Detailed technical write-ups are available at VulDB CVE-2026-19281 and the GitHub Issue Tracker.

No public exploit code has been published. See the GitHub Project Repository for source-level context.

Detection Methods for CVE-2026-19281

Indicators of Compromise

Process execution chains where a Node.js runtime spawns unexpected shell processes with arguments containing metacharacters such as ;, |, &, or $().
Invocations of the generateAssets tool with outputDir values that deviate from expected filesystem path formats.
Unexpected child processes launched from the slidev-builder-mcp working directory.

Detection Strategies

Monitor for anomalous child processes spawned by Node.js processes running slidev-builder-mcp components.
Instrument logging around calls to generateChart in src/tools/generateAssets.ts to capture the raw outputDir argument.
Apply static analysis rules that flag shell command construction using unsanitized user input in TypeScript source files.

Monitoring Recommendations

Enable command-line auditing on hosts running slidev-builder-mcp to record process arguments.
Alert on execution of interpreters such as /bin/sh or cmd.exe originating from the Node.js process tree.
Retain endpoint telemetry sufficient to reconstruct process lineage for post-incident review.

How to Mitigate CVE-2026-19281

Immediate Actions Required

Restrict local access to systems running slidev-builder-mcp 2.1.0 to trusted users only.
Remove or disable the generateAssets tool if it is not required for production workflows.
Audit any automation that invokes generateChart with externally sourced outputDir values.

Patch Information

No patch has been released. According to the VulDB advisory, the maintainers were notified via the GitHub Issue Tracker but have not responded. Users should monitor the GitHub Project Repository for future releases.

Workarounds

Replace direct shell command construction with parameterized APIs such as Node.js child_process.execFile that avoid shell interpretation.
Validate outputDir against an allow-list of permitted characters (for example, [A-Za-z0-9_./-]) before use.
Run the tool under a low-privilege service account to limit the impact of successful injection.
Consider pinning to an alternative maintained fork or removing the dependency until a fix is published.

bash

# Example allow-list validation before invoking the tool
if [[ ! "$OUTPUT_DIR" =~ ^[A-Za-z0-9_./-]+$ ]]; then
  echo "Invalid outputDir value" >&2
  exit 1
fi