CVE-2026-19330: Advanced Reasoning MCP Path Traversal Flaw

CVE-2026-19330 Overview

CVE-2026-19330 is a path traversal vulnerability [CWE-22] in angrysky56 advanced-reasoning-mcp version 1.0.0. The flaw resides in the src/index.ts file and affects the functions create_system_json, create_library, get_system_json, and switch_memory_library. An authenticated local attacker can manipulate file path parameters to access or write files outside intended directories. Exploitation requires local access and low privileges. The project maintainer was notified through an issue report but has not responded at the time of disclosure.

Critical Impact
Local users can read or modify files outside the intended memory library directory, potentially exposing configuration data or overwriting sensitive files.

Affected Products

angrysky56 advanced-reasoning-mcp 1.0.0
Components: create_system_json, create_library, get_system_json, switch_memory_library
Vulnerable file: src/index.ts

Discovery Timeline

2026-08-09 - CVE-2026-19330 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19330

Vulnerability Analysis

The advanced-reasoning-mcp project implements a Model Context Protocol (MCP) server that manages memory libraries and system JSON configuration files on the local filesystem. Four functions in src/index.ts accept user-supplied identifiers that are concatenated into filesystem paths without sanitization. Attackers supplying traversal sequences such as ../ can escape the intended data directory.

The vulnerability affects both read and write operations. get_system_json and switch_memory_library enable arbitrary file reads within the process's permissions. create_system_json and create_library enable arbitrary file writes to attacker-chosen locations. The EPSS score of 0.137% reflects the local access requirement and limited installation footprint.

Root Cause

The root cause is missing input validation on library and system identifiers passed to filesystem APIs. The affected functions treat user-controlled strings as trusted path segments. No canonicalization or allowlist check confirms that resolved paths remain within the intended base directory before file operations execute.

Attack Vector

Exploitation requires local access to the host running the MCP server and the ability to invoke the exposed tool functions. An attacker with a client connection to the MCP endpoint submits a crafted library name containing directory traversal sequences. The server resolves the path and reads or writes the target file with the privileges of the MCP process. See the GitHub Issue Tracker for the reported traversal behavior.

Because the project is written in TypeScript and executed via Node.js, successful traversal can target files such as ~/.ssh/, environment configuration, or other MCP server state on the same host. No verified public exploit is available.

Detection Methods for CVE-2026-19330

Indicators of Compromise

MCP request logs containing ../, ..\\, URL-encoded traversal (%2e%2e%2f), or absolute paths in library or system JSON parameters.
File creation or modification events under the MCP process outside the designated memory library directory.
Unexpected reads of sensitive files such as SSH keys, shell history, or configuration files timed with MCP tool invocations.

Detection Strategies

Instrument the MCP server to log the resolved absolute path for every call to create_system_json, create_library, get_system_json, and switch_memory_library.
Alert when resolved paths fall outside the configured library root directory.
Correlate MCP client requests with filesystem telemetry to identify traversal patterns in identifier arguments.

Monitoring Recommendations

Enable filesystem auditing (auditd on Linux, FSEvents on macOS) on the directory containing the MCP server and its data root.
Monitor Node.js process file descriptors for reads and writes outside the expected working directory.
Retain MCP request payloads for at least 30 days to support retrospective hunting once patches ship.

How to Mitigate CVE-2026-19330

Immediate Actions Required

Restrict access to the local host running advanced-reasoning-mcp to trusted users only.
Run the MCP server as an unprivileged user with a chroot or filesystem-scoped sandbox limiting access to the memory library directory.
Review MCP request logs for prior traversal attempts against the four affected functions.

Patch Information

No vendor patch is available at the time of publication. The maintainer has not responded to the GitHub issue report. Track updates on the GitHub Project Repository and the VulDB CVE Record for remediation status.

Workarounds

Fork the project and add path canonicalization using path.resolve() followed by a prefix check against the library base directory before any filesystem operation.
Reject any identifier containing /, \\, .., or null bytes before passing it to filesystem APIs.
Deploy the MCP server inside a container with a read-only root filesystem and a bind-mounted data volume scoped to the library directory.
Disable the create_system_json, create_library, get_system_json, and switch_memory_library tools in the MCP server configuration if they are not required.

bash

# Example: run advanced-reasoning-mcp in a scoped container
docker run --rm \
  --read-only \
  --user 1000:1000 \
  -v /srv/mcp/libraries:/app/data:rw \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  advanced-reasoning-mcp:local