CVE-2026-15751

MEDIUM 5.3

mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal

CVSS Score

5.3

EPSS Score

0.1%

EPSS Percentile

4th

A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the function execute of the file mastergo/component-workflow.md of the component mcp__getComponentGenerator. The manipulation of the argument rootPath leads to path traversal. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-22
Vendor	mastergo-design
Product	mastergo-magic-mcp
Published	Jul 14, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for mastergo-design mastergo-magic-mcp

Be the first to know when new medium vulnerabilities affecting mastergo-design mastergo-magic-mcp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

mastergo-design / mastergo-magic-mcp

0.1 0.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/378330 vuldb.com: https://vuldb.com/vuln/378330/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15751 vuldb.com: https://vuldb.com/submit/856634 github.com: https://github.com/mastergo-design/mastergo-magic-mcp/issues/90 github.com: https://github.com/mastergo-design/mastergo-magic-mcp/

Credits

🔍 Mcfly_Zhang (VulDB User) VulDB CNA Team