CVE-2026-19336: Pimzino spec-workflow-mcp Path Traversal

CVE-2026-19336 Overview

CVE-2026-19336 is a path traversal vulnerability [CWE-22] in Pimzino spec-workflow-mcp versions up to and including 2.2.6. The flaw resides in the ApprovalStorage.createApproval function within src/tools/approvals.ts. An attacker with local access can manipulate the categoryName argument to traverse outside the intended approval directory. The maintainer addressed the issue in version 2.2.7 through commit 9c7a7839e690bb4543f0e7481b5740d23808e5fe.

Critical Impact
Local attackers can manipulate categoryName to write approval files outside the intended directory, potentially overwriting sensitive files accessible to the running user.

Affected Products

Pimzino spec-workflow-mcp versions up to 2.2.6
Component: src/tools/approvals.ts (ApprovalStorage.createApproval function)
Component: src/dashboard/approval-storage.ts

Discovery Timeline

2026-08-09 - CVE-2026-19336 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19336

Vulnerability Analysis

The vulnerability exists in the approval workflow logic of spec-workflow-mcp, a Model Context Protocol (MCP) server. The createApproval function accepts a categoryName parameter that is used to construct filesystem paths for storing approval records. Prior to version 2.2.7, the function did not validate whether categoryName contained directory traversal sequences such as .. or path separators like / and \. An attacker with local access to the process can supply crafted categoryName values that resolve outside the intended approval storage directory. The exploitation requires local access and low privileges, limiting the blast radius but still enabling unauthorized filesystem writes in the context of the process user.

Root Cause

The root cause is missing input validation on user-controlled path segments [CWE-22]. The categoryName argument was concatenated directly into filesystem paths without sanitization or normalization checks. Both src/tools/approvals.ts and src/dashboard/approval-storage.ts lacked guards against .. sequences and directory separators.

Attack Vector

Exploitation requires local access to the MCP server and the ability to invoke the approval creation tool. An attacker submits a request containing a malicious categoryName such as ../../etc to escape the intended approval directory and write approval files to arbitrary locations writable by the service account.

typescript

// Security patch in src/tools/approvals.ts
// fix: prevent path traversal in approval categoryName (issue #220)

    };
  }

+    // Security: Validate categoryName to prevent path traversal in approval directory names
+    if (args.categoryName.includes('..') || args.categoryName.includes('/') || args.categoryName.includes('\\')) {
+      await approvalStorage.stop();
+      return {
+        success: false,
+        message: 'Security error: categoryName must be a simple name without path traversal or directory separators.'
+      };
+    }
+
    const isMarkdownFile = args.filePath.toLowerCase().endsWith('.md');
    let markdownContent: string | undefined;

Source: GitHub Commit 9c7a7839

Detection Methods for CVE-2026-19336

Indicators of Compromise

Approval files or directories appearing outside the configured approval storage path.
Log entries or MCP request payloads where categoryName contains .., /, or \ characters.
Unexpected file writes by the spec-workflow-mcp process user in system or user configuration directories.

Detection Strategies

Inspect application logs and MCP tool invocations for createApproval calls with suspicious categoryName values.
Perform filesystem integrity monitoring on directories adjacent to the approval storage location.
Audit installed versions of spec-workflow-mcp and flag any instance at 2.2.6 or earlier.

Monitoring Recommendations

Enable process-level file write auditing for the user account running the MCP server.
Correlate MCP request telemetry with filesystem write events to identify traversal attempts.
Track dependency inventories to detect regressions to vulnerable versions of the package.

How to Mitigate CVE-2026-19336

Immediate Actions Required

Upgrade spec-workflow-mcp to version 2.2.7 or later, which contains the fix in commit 9c7a7839e690bb4543f0e7481b5740d23808e5fe.
Restrict local access to the MCP server to trusted users and workloads only.
Review approval storage directories for unexpected files created before the upgrade.

Patch Information

The fix is available in spec-workflow-mcp version 2.2.7. Commit 9c7a7839e690bb4543f0e7481b5740d23808e5fe introduces validation that rejects any categoryName containing .., /, or \. See the GitHub Pull Request #222 and the GitHub Issue #220 for full context.

Workarounds

If upgrading is not immediately feasible, wrap or fork the tool to validate categoryName inputs against an allowlist of simple identifiers.
Run the MCP server under a least-privilege user account with write access limited to the approval storage directory.
Restrict who can invoke the createApproval tool through host-level access controls.

bash

# Upgrade to the patched version
npm install spec-workflow-mcp@2.2.7

# Verify the installed version
npm ls spec-workflow-mcp