CVE-2026-19324 Overview
CVE-2026-19324 is a path traversal vulnerability [CWE-22] in HelloGGX shadcn-vue-mcp affecting commits up to e170e277b94235cde627803277fc8c41103a4d38. The flaw resides in the fs.promises.readFile call inside src/server/callback-server.ts. An attacker with local access can manipulate the filepath argument to read files outside the intended directory. The project uses a rolling release strategy, so specific fixed versions are not published. According to the disclosure record, the maintainer was notified through a GitHub issue but has not yet responded.
Critical Impact
A local attacker with low privileges can traverse the file system through an unsanitized filepath parameter and read arbitrary files accessible to the running process.
Affected Products
- HelloGGX shadcn-vue-mcp (rolling release)
- Commits up to e170e277b94235cde627803277fc8c41103a4d38
- Component: src/server/callback-server.ts
Discovery Timeline
- 2026-08-09 - CVE-2026-19324 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19324
Vulnerability Analysis
The vulnerability exists in the callback server component of shadcn-vue-mcp, a Model Context Protocol (MCP) server for shadcn-vue components. The callback-server.ts file handles HTTP requests and passes a caller-controlled filepath value directly to fs.promises.readFile. Because the input is not normalized or constrained to an allowlisted base directory, ../ sequences and absolute paths resolve outside the intended asset directory. Successful exploitation returns the contents of any file the Node.js process can read. The attack surface is limited to local execution, meaning the attacker must reach the callback server endpoint on the host or via bound loopback services.
Root Cause
The root cause is missing input validation on a filesystem path parameter [CWE-22]. The handler concatenates or forwards untrusted input to fs.promises.readFile without calling path.resolve against a fixed root and rejecting escapes. There is no canonicalization check comparing the resolved path against the expected base directory.
Attack Vector
An attacker with local access to the callback server sends a request containing a crafted filepath value such as a relative traversal string or absolute path. The Node.js runtime resolves the path and returns file contents through the HTTP response. Exploitation requires low privileges and no user interaction, but the attack is not remotely reachable in default configurations.
No verified exploit code is publicly available. See the GitHub Issue Discussion and the VulDB CVE Report for additional technical context.
Detection Methods for CVE-2026-19324
Indicators of Compromise
- HTTP requests to the shadcn-vue-mcp callback server containing ../, ..\, encoded traversal sequences (%2e%2e%2f), or absolute paths in a filepath parameter.
- Node.js process reads of sensitive files such as /etc/passwd, SSH keys, or .env files outside the project directory.
- Unexpected outbound responses from the callback server containing file contents unrelated to shadcn-vue assets.
Detection Strategies
- Enable filesystem auditing on developer workstations running MCP servers and flag reads of sensitive paths by node processes.
- Inspect HTTP access logs from callback-server.ts for query strings or request bodies containing traversal patterns.
- Add a static analysis rule that identifies calls to fs.promises.readFile receiving unvalidated request parameters.
Monitoring Recommendations
- Monitor for local privilege escalation or lateral movement following anomalous file access by MCP-related Node.js processes.
- Track network connections to callback server ports bound on loopback or LAN interfaces.
- Correlate developer endpoint telemetry with process-level file read events to identify traversal attempts.
How to Mitigate CVE-2026-19324
Immediate Actions Required
- Stop running the shadcn-vue-mcp callback server on untrusted or multi-user hosts until a fix is available.
- Bind the callback server strictly to 127.0.0.1 and block external access at the host firewall.
- Run the MCP server under a dedicated low-privilege account with filesystem access limited to the project directory.
Patch Information
No official patch has been released. The maintainer was notified through the GitHub Issue Discussion but has not responded. Because the project follows a rolling release strategy, users should monitor the GitHub PoC Repository for commits addressing input validation in src/server/callback-server.ts.
Workarounds
- Fork the project and patch callback-server.ts to resolve filepath against a fixed base directory using path.resolve and reject paths outside the allowlisted root.
- Wrap fs.promises.readFile calls with a canonicalization check that rejects any resolved path not beginning with the intended asset directory.
- Apply an allowlist of permitted filenames rather than accepting arbitrary user-supplied paths.
# Configuration example: restrict callback server to loopback only
# and run under a dedicated low-privilege user
sudo useradd -r -s /usr/sbin/nologin shadcn-mcp
sudo -u shadcn-mcp HOST=127.0.0.1 PORT=3000 node src/server/callback-server.ts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
