CVE-2026-19328
aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed locally. Upgrading to version 0.1.1 is recommended to address this issue. The identifier of the patch is 855b46739e0f6e8388f17f9d0066ac4298a3965d. Upgrading the affected component is recommended.
| CWE | CWE-22 |
| Vendor | aktsmm |
| Product | skill-ninja-mcp-server |
| Published | Aug 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for aktsmm skill-ninja-mcp-server
Be the first to know when new medium vulnerabilities affecting aktsmm skill-ninja-mcp-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
aktsmm / skill-ninja-mcp-server
0.1.0
References
vuldb.com: https://vuldb.com/vuln/387162 vuldb.com: https://vuldb.com/vuln/387162/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19328 vuldb.com: https://vuldb.com/submit/865245 github.com: https://github.com/aktsmm/skill-ninja-mcp-server/issues/2 github.com: https://github.com/aktsmm/skill-ninja-mcp-server/commit/855b46739e0f6e8388f17f9d0066ac4298a3965d github.com: https://github.com/aktsmm/skill-ninja-mcp-server/releases/tag/v0.1.1 github.com: https://github.com/aktsmm/skill-ninja-mcp-server/
Credits
🔍 gongyanyu03 (VulDB User)