CVE-2026-19328: Skill Ninja MCP Server Path Traversal

CVE-2026-19328 Overview

CVE-2026-19328 is a path traversal vulnerability [CWE-22] in aktsmm/skill-ninja-mcp-server version 0.1.0. The flaw resides in the getInstalledSkills, installSkill, updateAgentsMd, and uninstallSkill functions within src/installer.ts. An attacker with local access can manipulate the workspacePath argument to traverse outside the intended workspace directory. This allows unauthorized read, write, or deletion of files on the host system. The maintainer released version 0.1.1 containing the fix in commit 855b46739e0f6e8388f17f9d0066ac4298a3965d.

Critical Impact
Local attackers can read, modify, or remove files outside the intended workspace by supplying crafted workspacePath values to installer functions in the MCP server.

Affected Products

aktsmm skill-ninja-mcp-server 0.1.0
src/installer.ts module (getInstalledSkills, installSkill, updateAgentsMd, uninstallSkill)
Model Context Protocol (MCP) integrations relying on the affected server version

Discovery Timeline

2026-08-09 - CVE-2026-19328 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19328

Vulnerability Analysis

The skill-ninja-mcp-server exposes tools that accept a workspacePath parameter representing an absolute directory used for skill installation and agent metadata updates. The installer functions in src/installer.ts use this value directly when reading, writing, or removing files. Because no validation constrains the path to a trusted root, an attacker can supply sequences that resolve outside the expected directory. This enables path traversal against arbitrary filesystem locations accessible to the process user.

The issue is exploitable only from a local context, since the attacker must invoke the MCP tool interface. However, MCP servers are frequently launched by AI coding assistants with the privileges of the developer, expanding the effective blast radius to any file that user can access.

Root Cause

The root cause is missing validation of user-controlled path input against a trusted workspace root. The functions treat the workspacePath argument as authoritative and perform filesystem operations without canonicalization or containment checks. This matches the CWE-22 pattern of improper limitation of a pathname to a restricted directory.

Attack Vector

An attacker able to send tool requests to the MCP server passes a crafted workspacePath value pointing to a sensitive location. When installSkill or updateAgentsMd executes, the server writes attacker-controlled content to that path. When uninstallSkill executes, files at the traversed path can be removed. The getInstalledSkills function similarly discloses filesystem contents outside the workspace.

typescript

// Patch excerpt from src/index.ts - clarifying trusted workspace requirement
         },
         workspacePath: {
           type: "string",
-          description: "Absolute path to the workspace directory",
+          description: "Absolute path to a trusted workspace directory",
         },
       },
       required: ["skillName", "workspacePath"],

Source: GitHub Commit 855b467

Detection Methods for CVE-2026-19328

Indicators of Compromise

Unexpected files named AGENTS.md or skill artifacts appearing outside the developer's project directory.
MCP tool invocations where workspacePath contains .., absolute paths outside declared project roots, or symbolic link targets.
Modifications or deletions in ~/.ssh, ~/.config, or other sensitive user directories correlated with MCP server activity.

Detection Strategies

Enable verbose logging on the MCP server process and inspect the workspacePath argument passed to installer.ts functions.
Compare pre- and post-execution filesystem snapshots of the developer workstation to identify writes outside expected workspaces.
Alert on any invocation of skill-ninja-mcp-server version 0.1.0 in package manifests or dependency lockfiles.

Monitoring Recommendations

Monitor process execution telemetry for Node.js processes hosting the skill-ninja-mcp-server package and correlate with file write events.
Track outbound MCP protocol traffic to identify unexpected tool-call payloads containing traversal sequences.
Audit developer endpoints for installed MCP server versions and flag anything prior to 0.1.1.

How to Mitigate CVE-2026-19328

Immediate Actions Required

Upgrade aktsmm/skill-ninja-mcp-server to version 0.1.1 or later, which enforces trusted workspace roots.
Audit MCP configurations under .vscode/mcp.json and remove references to untrusted workspaces.
Restart any AI assistant or IDE session that loaded the vulnerable server to ensure the patched binary is in use.

Patch Information

The fix is delivered in commit 855b46739e0f6e8388f17f9d0066ac4298a3965d and released as version 0.1.1. See the GitHub Release v0.1.1, the patch commit, and the issue tracker discussion for details. The patch enforces trusted workspace roots and cleans repository artifacts through updated .gitignore entries and revised parameter descriptions in src/index.ts.

Workarounds

Run the MCP server under a least-privilege user account whose filesystem access is limited to the intended workspace tree.
Wrap MCP tool invocations with a validation layer that rejects workspacePath values containing .. or resolving outside a whitelist of trusted project roots.
Disable or uninstall the skill-ninja-mcp-server package until the upgrade to 0.1.1 is complete.

bash

# Upgrade to the patched release
npm install skill-ninja-mcp-server@0.1.1

# Verify installed version
npm ls skill-ninja-mcp-server