CVE-2026-19328 aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal

A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...

CVE-2026-19328

Summary (CVE-2026-19328): The vulnerability affects aktsmm skill-ninja-mcp-server version 0.1.0, specifically the functions getInstalledSkills, installSkill, updateAgentsMd, and uninstallSkill in src/installer.ts. The issue is a local path traversal caused by manipulation of the workspacePath arg...