A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFil…
Medium CVSS 5.3
Summary
A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to path traversal. The attack needs to be performed locally. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. T…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/astralisone/rive-mcp-server-core/
- https://github.com/astralisone/rive-mcp-server-core/issues/2
- https://vuldb.com/cve/CVE-2026-19288
- https://vuldb.com/submit/865239
- https://vuldb.com/vuln/387027
- https://vuldb.com/vuln/387027/cti
Timeline
- nvd_ingest NVD