CVE-2026-19288 Overview
CVE-2026-19288 is a path traversal vulnerability in the astralisone rive-mcp-server-core project, affecting builds up to commit db1d0cc4cd52589116360428b7504fd0ca748b3e. The flaw resides in the importRiveFile Flow component, specifically in packages/mcp-server/src/tools/importRiveFile.ts, where the libraryId argument is not properly sanitized before use in file system operations [CWE-22].
The project follows a rolling release model, so no fixed version identifier is available. The maintainers received an early issue report but had not responded at the time of publication. Exploitation requires local access and low privileges.
Critical Impact
A local, authenticated attacker can manipulate the libraryId parameter to traverse directories outside the intended library path, potentially reading or writing files beyond the server's scope.
Affected Products
- astralisone/rive-mcp-server-core up to commit db1d0cc4cd52589116360428b7504fd0ca748b3e
- packages/mcp-server/src/tools/importRiveFile.ts (importRiveFile Flow)
- Rolling release: no fixed version identifier available
Discovery Timeline
- 2026-08-08 - CVE-2026-19288 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19288
Vulnerability Analysis
The vulnerability exists in the importRiveFile tool implemented in packages/mcp-server/src/tools/importRiveFile.ts. The tool accepts a libraryId argument that is incorporated into a file system path without adequate validation or canonicalization. An attacker can supply traversal sequences such as ../ in libraryId to escape the intended library directory.
Because the flaw is a path traversal issue classified under CWE-22, successful exploitation depends on how the resolved path is subsequently used, whether for reading, writing, or importing files. The attack vector is local, and the attacker must already hold low-level privileges on the host running the MCP server.
The project has not published a patch. Because rive-mcp-server-core uses a rolling release model, defenders should track the specific commit hash rather than a semantic version. See the GitHub Issue Tracker for the public disclosure.
Root Cause
The root cause is missing input validation on the libraryId argument. The importRiveFile Flow concatenates or joins libraryId into a filesystem path without rejecting traversal metacharacters or resolving the final path against an allow-listed base directory.
Attack Vector
An attacker with local access to the MCP server invokes the importRiveFile tool and supplies a crafted libraryId value containing path traversal sequences. The server resolves the path outside the intended library root, allowing access to files the tool should not reach. No user interaction is required.
The vulnerability manifests when untrusted input reaches file path construction logic. See the VulDB entry for CVE-2026-19288 for additional technical context.
Detection Methods for CVE-2026-19288
Indicators of Compromise
- Requests to the importRiveFile MCP tool where the libraryId argument contains ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute paths.
- File access events originating from the MCP server process targeting paths outside the configured library directory.
- Unexpected reads of sensitive files such as configuration, credential stores, or SSH keys by the Node.js process hosting rive-mcp-server-core.
Detection Strategies
- Instrument the importRiveFile handler to log the raw libraryId value and the resolved absolute path, then alert on deviations from the expected base directory.
- Deploy filesystem auditing (auditd, Sysmon FileCreate/FileRead) on the MCP server host to flag reads or writes outside the library root by the server process.
- Review MCP request logs for libraryId payloads matching traversal patterns using regex-based detections.
Monitoring Recommendations
- Baseline the set of directories legitimately accessed by the rive-mcp-server-core process and alert on any access outside that baseline.
- Forward MCP server logs and host filesystem telemetry to a centralized analytics platform for correlation with process and user context.
- Monitor the upstream GitHub Repository and GitHub Issue Tracker for a maintainer response or fix commit.
How to Mitigate CVE-2026-19288
Immediate Actions Required
- Restrict local access to hosts running rive-mcp-server-core and enforce least-privilege for accounts that can invoke MCP tools.
- Disable or gate the importRiveFile tool if it is not required for current workflows.
- Apply an input filter that rejects libraryId values containing .., path separators, or absolute paths before the request reaches the tool handler.
Patch Information
No official patch is available at the time of publication. The maintainers were notified through the public GitHub Issue Tracker but have not responded. Track the repository for a fix commit that supersedes db1d0cc4cd52589116360428b7504fd0ca748b3e and validate that the fix canonicalizes and validates libraryId against an allow-listed base directory.
Workarounds
- Wrap the importRiveFile handler with a validator that resolves the target path with path.resolve() and confirms it starts with the intended library base directory before any filesystem operation.
- Run the MCP server under a dedicated low-privilege user account with filesystem permissions limited to the library directory.
- Apply mandatory access controls (AppArmor, SELinux) to constrain the process to specific directories, blocking traversal even if the application logic fails.
# Configuration example: constrain the MCP server to its library directory
# Run as a dedicated user with a chroot-like scope enforced by systemd
[Service]
User=rive-mcp
Group=rive-mcp
ReadWritePaths=/var/lib/rive-mcp/libraries
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
