CVE-2026-33989

CVE-2026-33989 affects the @mobilenext/mobile-mcp server. Before v0.0.49, the tools mobile_save_screenshot and mobile_start_screen_recording pass saveTo/output directly to filesystem operations without path validation, enabling an attacker to perform path traversal and write files outside the int...