CVE-2026-19372 Overview
CVE-2026-19372 is a path traversal vulnerability [CWE-22] in Handwriting-OCR handwriting-ocr-mcp-server version 0.1.0. The flaw resides in the fs.readFileSync call within src/index.ts, part of the upload_document component. An attacker with local access can manipulate the File argument to traverse outside the intended directory and read arbitrary files. Exploitation requires local access and low privileges, limiting the practical attack surface. The project maintainers were notified through a public issue report but have not responded at the time of disclosure. No vendor patch is currently available.
Critical Impact
Local attackers with low privileges can read files outside the intended directory scope by supplying crafted path values to the upload_document handler.
Affected Products
- Handwriting-OCR handwriting-ocr-mcp-server version 0.1.0
- Component: upload_document in src/index.ts
- Function: fs.readFileSync
Discovery Timeline
- 2026-08-09 - CVE-2026-19372 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19372
Vulnerability Analysis
The vulnerability exists in the Model Context Protocol (MCP) server implementation for Handwriting-OCR. The upload_document handler accepts a File argument that is passed directly to fs.readFileSync in src/index.ts. The server does not normalize or validate the path against a permitted base directory before reading its contents.
Because fs.readFileSync resolves relative segments such as ../, an attacker who controls the File parameter can escape the intended upload directory. The resulting file contents are returned through the MCP tool response, giving the caller read access to files elsewhere on the host filesystem. The vulnerability is classified as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.
Root Cause
The root cause is missing input sanitization on the File argument in the upload_document tool. The code does not apply path.resolve against an allowlisted base directory, does not reject absolute paths, and does not filter .. traversal sequences before invoking fs.readFileSync.
Attack Vector
Exploitation requires local access to the MCP server and low privileges to invoke the upload_document tool. The attacker submits a File value containing traversal sequences or an absolute path pointing at a target file. The server reads and returns the file contents. Because MCP servers frequently run inside developer environments with access to source code, credentials, and configuration, arbitrary read access can lead to secondary compromise.
No verified exploit code is publicly available. Technical details are tracked in the GitHub Issue Tracker and the VulDB CVE-2026-19372 entry.
Detection Methods for CVE-2026-19372
Indicators of Compromise
- MCP tool invocations of upload_document where the File argument contains .. sequences or absolute paths outside the expected upload directory.
- Unexpected reads by the Node.js process hosting handwriting-ocr-mcp-server against sensitive files such as /etc/passwd, .env, SSH keys, or cloud credential files.
- Error entries in MCP server logs referencing ENOENT or EACCES on files outside the intended working directory.
Detection Strategies
- Enable Node.js process auditing and inspect calls to fs.readFileSync originating from src/index.ts in the handwriting-ocr-mcp-server package.
- Deploy filesystem access auditing (Linux auditd, macOS Endpoint Security) scoped to the user account running the MCP server and alert on reads outside the designated document directory.
- Review MCP protocol logs for upload_document parameters and flag traversal indicators before the request is dispatched.
Monitoring Recommendations
- Monitor for outbound transfers of sensitive local files immediately following upload_document requests.
- Track version pinning of the handwriting-ocr-mcp-server dependency in software bills of materials to identify hosts still running 0.1.0.
- Alert on new MCP tool registrations that read from arbitrary filesystem paths without an allowlist.
How to Mitigate CVE-2026-19372
Immediate Actions Required
- Remove or disable the handwriting-ocr-mcp-server 0.1.0 package from any environment where it is not strictly required.
- Restrict access to the MCP server so that only trusted local users can invoke the upload_document tool.
- Run the MCP server under a dedicated low-privilege account with filesystem access limited to a dedicated upload directory.
Patch Information
No vendor patch is available. The project was notified through the GitHub Issue Tracker but has not responded. Track updates on the GitHub Project Repository and the VulDB CVE-2026-19372 advisory for remediation status.
Workarounds
- Fork the project and add path normalization: resolve the File argument against a fixed base directory using path.resolve and reject any resolved path outside that base.
- Reject File values containing .., null bytes, or absolute path prefixes before invoking fs.readFileSync.
- Run the MCP server inside a sandbox (container, chroot, or macOS App Sandbox) so that a successful traversal cannot reach sensitive host files.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
