What is CVE-2026-19370?
CVE-2026-19370 is a path traversal vulnerability in bartekke8it56w2 new-mcp 0.1.0 affecting the geminithinking component in index.ts. It impacts fs.writeFileSync/fs.existsSync/fs.readFileSync functions by manipulating sessionCommand/sessionPath arguments. A local attacker can access unintended files, so immediate patching and input validation are required.
Azərbaycanca: CVE-2026-19370 bartekke8it56w2 new-mcp 0.1.0 versiyasında aşkarlanan path traversal zəifliyidir. Bu, index.ts faylındakı geminithinking komponentində fs.writeFileSync/fs.existsSync/fs.readFileSync funksiyalarına təsir edir. Yerli hücumçu sessionCommand/sessionPath arqumentlərini manipulyasiya edərək fayl sistemi əməliyyatlarını yönləndirə bilər, təcili yenilənmə tətbiq edilməli və giriş parametrləri yoxlanmalıdır.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
In which product and version was CVE-2026-19370 discovered?
This path traversal vulnerability was discovered in version 0.1.0 of bartekke8it56w2 new-mcp.
How can an attacker impact the file system?
A local attacker can manipulate the sessionCommand and sessionPath arguments in the geminithinking component within index.ts to exploit the fs.writeFileSync, fs.existsSync, and fs.readFileSync functions.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.