Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by HelloGGX

    CVE-2026-19324 (GCVE-0-2026-19324)

    Vulnerability from nvd – Published: 2026-08-09 01:30 – Updated: 2026-08-09 01:30
    VLAI
    Title
    HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal
    Summary
    A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restricted to local execution. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
    Severity
    4.8 (Medium)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    3.3 (Low)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    3.3 (Low)
    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    HelloGGX shadcn-vue-mcp Affected: e170e277b94235cde627803277fc8c41103a4d38
        cpe:2.3:a:helloggx:shadcn-vue-mcp:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    gongyanyu03 (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:helloggx:shadcn-vue-mcp:*:*:*:*:*:*:*:*"
          ],
          "product": "shadcn-vue-mcp",
          "vendor": "HelloGGX",
          "versions": [
            {
              "status": "affected",
              "version": "e170e277b94235cde627803277fc8c41103a4d38"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "gongyanyu03 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restricted to local execution. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-09T01:30:11.521Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-387158 | HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/387158"
        },
        {
          "name": "VDB-387158 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/387158/cti"
        },
        {
          "name": "CVE-2026-19324 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-19324"
        },
        {
          "name": "Submit #865241 | HelloGGX shadcn-vue-mcp unknown Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/865241"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/HelloGGX/shadcn-vue-mcp/issues/14"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/HelloGGX/shadcn-vue-mcp/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-08T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-08T11:13:09.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-19324",
    "datePublished": "2026-08-09T01:30:11.521Z",
    "dateReserved": "2026-08-08T09:07:54.466Z",
    "dateUpdated": "2026-08-09T01:30:11.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19324 (GCVE-0-2026-19324)

    Vulnerability from cvelistv5 – Published: 2026-08-09 01:30 – Updated: 2026-08-09 01:30
    VLAI
    Title
    HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal
    Summary
    A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restricted to local execution. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
    Severity
    4.8 (Medium)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    3.3 (Low)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    3.3 (Low)
    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    HelloGGX shadcn-vue-mcp Affected: e170e277b94235cde627803277fc8c41103a4d38
        cpe:2.3:a:helloggx:shadcn-vue-mcp:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    gongyanyu03 (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:helloggx:shadcn-vue-mcp:*:*:*:*:*:*:*:*"
          ],
          "product": "shadcn-vue-mcp",
          "vendor": "HelloGGX",
          "versions": [
            {
              "status": "affected",
              "version": "e170e277b94235cde627803277fc8c41103a4d38"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "gongyanyu03 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restricted to local execution. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-09T01:30:11.521Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-387158 | HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/387158"
        },
        {
          "name": "VDB-387158 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/387158/cti"
        },
        {
          "name": "CVE-2026-19324 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-19324"
        },
        {
          "name": "Submit #865241 | HelloGGX shadcn-vue-mcp unknown Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/865241"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/HelloGGX/shadcn-vue-mcp/issues/14"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/HelloGGX/shadcn-vue-mcp/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-08T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-08T11:13:09.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-19324",
    "datePublished": "2026-08-09T01:30:11.521Z",
    "dateReserved": "2026-08-08T09:07:54.466Z",
    "dateUpdated": "2026-08-09T01:30:11.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}