CVE-2026-19338: MCPyATS Path Traversal Vulnerability

CVE-2026-19338 Overview

CVE-2026-19338 is a path traversal vulnerability [CWE-22] in the automateyournetwork MCPyATS project through version 0.1.4. The flaw resides in the processGenerateRequest function within mcp_servers/mermaid/index.ts, part of the generate_mermaid_markdown component. An attacker with local access can manipulate the folder or name argument to traverse directory boundaries and access files outside the intended path. Exploitation requires local access and low privileges, limiting the practical attack surface. The issue was disclosed publicly through the project's GitHub repository and tracked by VulDB.

Critical Impact
Local attackers with low privileges can read or write files outside of the intended directory by supplying crafted folder or name parameters to the Mermaid MCP server.

Affected Products

automateyournetwork MCPyATS versions up to and including 0.1.4
Component: generate_mermaid_markdown
File: mcp_servers/mermaid/index.ts

Discovery Timeline

2026-08-09 - CVE-2026-19338 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19338

Vulnerability Analysis

MCPyATS is a Model Context Protocol (MCP) server implementation that integrates network automation tooling. The Mermaid MCP server module exposes a generate_mermaid_markdown capability that accepts a folder and name argument to write generated Mermaid diagrams to disk. The processGenerateRequest function in mcp_servers/mermaid/index.ts concatenates these arguments into a filesystem path without sufficient normalization or validation.

An attacker who can supply arguments to the MCP server locally can inject relative path sequences such as ../ into the folder or name parameters. The resulting path escapes the intended output directory. Depending on the operating context, this allows arbitrary file write or file overwrite in locations accessible to the MCP process. The vulnerability requires local access and authenticated low-privilege interaction with the MCP endpoint.

Root Cause

The root cause is missing path canonicalization and lack of a boundary check that ensures the resolved output path remains within an allow-listed base directory. The folder and name arguments are treated as trusted input and are used directly in filesystem operations.

Attack Vector

The attack vector is local. An attacker interacts with the MCP server, invokes the generate_mermaid_markdown tool, and supplies argument values that contain directory traversal sequences. Because MCP servers are commonly co-located with the user's shell or agent runtime, any process able to reach the local MCP transport can trigger the flaw.

No verified exploit code has been published. Technical details are documented in the project's GitHub Issue #22 and the VulDB entry for CVE-2026-19338.

Detection Methods for CVE-2026-19338

Indicators of Compromise

Files written by the MCPyATS process outside of the expected Mermaid output directory
MCP request logs containing folder or name parameters with ../, ..\, or absolute path prefixes
Unexpected modifications to configuration or dotfiles in the home directory of the account running the MCP server

Detection Strategies

Enable verbose logging on the MCPyATS MCP servers and capture all tool invocations, including argument payloads for generate_mermaid_markdown
Alert on any path arguments containing traversal sequences or absolute paths
Compare files written by the Node.js runtime hosting mcp_servers/mermaid/index.ts against an allow-listed output directory

Monitoring Recommendations

Monitor filesystem write activity from the Node.js process running the MCP server using EDR file telemetry
Track parent-child process relationships between AI agents, IDEs, and local MCP servers to establish a baseline of expected usage
Review the MCPyATS repository for new releases and re-run detections after upgrades

How to Mitigate CVE-2026-19338

Immediate Actions Required

Restrict local access to systems running MCPyATS to trusted users only
Run the MCPyATS process under a least-privilege service account with no write access outside its working directory
Audit mcp_servers/mermaid/index.ts locally and remove or disable the generate_mermaid_markdown tool if it is not required

Patch Information

At time of publication, no vendor patch has been referenced in the NVD entry. Track the MCPyATS GitHub repository and GitHub Issue #22 for a fixed release beyond version 0.1.4. When a patched version is released, upgrade all MCPyATS deployments and verify the fix by supplying traversal payloads in a test environment.

Workarounds

Wrap the processGenerateRequest handler with a path canonicalization step using path.resolve and verify the resolved path starts with the intended base directory
Reject any folder or name value containing .., path separators, or absolute path prefixes before invoking filesystem APIs
Confine the MCP server using OS-level sandboxing such as containers, AppArmor, SELinux, or macOS sandbox profiles to limit reachable filesystem locations

bash

# Example allow-list check to add in mcp_servers/mermaid/index.ts
const path = require('path');
const BASE_DIR = path.resolve('/var/lib/mcpyats/mermaid');
const target = path.resolve(BASE_DIR, folder, name);
if (!target.startsWith(BASE_DIR + path.sep)) {
  throw new Error('Invalid path: traversal detected');
}