CVE-2026-19370: new-mcp Path Traversal Vulnerability

CVE-2026-19370 Overview

CVE-2026-19370 is a path traversal vulnerability [CWE-22] in bartekke8it56w2 new-mcp version 0.1.0. The flaw resides in the geminithinking component within index.ts, specifically in the fs.writeFileSync, fs.existsSync, and fs.readFileSync operations. An attacker with local access can manipulate the sessionCommand and sessionPath arguments to traverse outside intended directories. The project maintainer was notified through a public issue but has not responded. No patched version is currently available.

Critical Impact
Local attackers with low privileges can read from or write to arbitrary file paths on the host by supplying crafted sessionPath or sessionCommand values, leading to limited disclosure or tampering of files accessible to the running process.

Affected Products

bartekke8it56w2/new-mcp version 0.1.0
Component: geminithinking in index.ts
Deployments exposing sessionCommand or sessionPath inputs to untrusted local callers

Discovery Timeline

2026-08-09 - CVE-2026-19370 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19370

Vulnerability Analysis

The vulnerability exists in the geminithinking component of new-mcp 0.1.0. The code passes user-supplied sessionCommand and sessionPath values directly to Node.js filesystem calls fs.writeFileSync, fs.existsSync, and fs.readFileSync. Because the paths are not canonicalized or restricted to an allow-listed base directory, traversal sequences such as ../ resolve to arbitrary locations on disk. The result is a classic path traversal condition that breaks the boundary between session storage and the wider filesystem.

Exploitation requires local access to the process accepting these inputs, and the impact is scoped to the privileges of the running process. Confidentiality, integrity, and availability effects are each limited but present, since an attacker can both read and write files reachable by that process.

Root Cause

The root cause is missing input validation on file path parameters. The geminithinking handler concatenates or forwards sessionCommand and sessionPath to fs calls without normalizing the resulting path or verifying that it stays within an intended session directory. There is no allow-listing, no path.resolve boundary check, and no rejection of .. segments.

Attack Vector

A local attacker who can supply sessionCommand or sessionPath to the vulnerable interface crafts values containing directory traversal sequences. When the handler builds the target filename, the traversal escapes the session directory. Depending on which fs operation is invoked, the attacker can probe file existence with fs.existsSync, exfiltrate content through fs.readFileSync, or overwrite files with fs.writeFileSync. See the GitHub issue tracker for new-mcp for the original report and the VulDB CVE database entry for additional metadata.

No verified exploit code is published for this issue. Refer to the GitHub PoC repository for the source under analysis.

Detection Methods for CVE-2026-19370

Indicators of Compromise

Session-related files created or modified outside the expected session storage directory used by new-mcp.
Log entries or telemetry showing sessionPath or sessionCommand values containing .., absolute paths, or unexpected separators.
Unexpected reads or writes by the Node.js process hosting new-mcp against sensitive files such as SSH keys, environment files, or configuration under the user's home directory.

Detection Strategies

Perform static review of index.ts in the geminithinking component for direct passage of sessionCommand or sessionPath into fs.writeFileSync, fs.existsSync, or fs.readFileSync without path.resolve boundary enforcement.
Enable filesystem auditing (auditd on Linux, Sysmon FileCreate/FileDelete on Windows) scoped to the process running new-mcp, and alert on writes outside the session directory.
Add application-level logging that captures the pre- and post-normalization form of any user-controlled path before it reaches an fs call.

Monitoring Recommendations

Baseline the legitimate directories used by the new-mcp runtime and alert on file operations that fall outside that baseline.
Monitor for local invocations of the vulnerable interface by low-privileged users who should not be interacting with the MCP service.
Track process-to-file relationships in EDR telemetry to identify anomalous file access patterns originating from the Node.js process.

How to Mitigate CVE-2026-19370

Immediate Actions Required

Restrict local access to the host running new-mcp 0.1.0 to trusted users only until a patch is available.
Run the service under a dedicated, low-privilege account with no read or write access to sensitive files outside its session directory.
Consider removing or disabling the geminithinking component if it is not required for production use.

Patch Information

No vendor patch is available. The maintainer of bartekke8it56w2/new-mcp was informed through the public GitHub issue tracker but has not responded. Track the project repository and the VulDB vulnerability record for updates.

Workarounds

Wrap all fs calls in geminithinking with a canonicalization check: resolve the requested path with path.resolve and reject any result that does not start with the intended session base directory.
Reject sessionPath and sessionCommand values containing .., null bytes, or absolute path prefixes before they reach filesystem APIs.
Enforce operating system level containment such as chroot, a bind-mount jail, or a container with a read-only root filesystem to limit the blast radius of any successful traversal.

bash

# Example Node.js boundary check to reject traversal outside the session directory
const path = require('path');
const SESSION_ROOT = path.resolve('/var/lib/new-mcp/sessions');

function safeSessionPath(userInput) {
  const resolved = path.resolve(SESSION_ROOT, userInput);
  if (!resolved.startsWith(SESSION_ROOT + path.sep)) {
    throw new Error('Path traversal attempt rejected');
  }
  return resolved;
}