CVE-2026-19328

The CVSS 5.3 on CVE-2026-19328 badly understates the risk. Four functions in the skill-ninja-mcp-server package — getInstalledSkills, installSkill, updateAgentsMd, and uninstallSkill — all fail on the same path traversal vector through the workspacePath parameter. That's not coincidental bad luck; that's a shared path-resolution utility reused across the entire installer module without sanitization. The pattern tells you exactly where the architectural debt lives, and it almost certainly means whatever comes next in this codebase will carry the same flaw. The 'local access required' qualifier in the CVE is the second thing that should worry you. MCP servers are explicitly designed to be invoked by external clients with arbitrary arguments — these aren't accidentally-exposed internal functions, they're protocol-surface by design. In modern development environments, 'local' means little: CI runners, containerized build agents, shared sandbox environments, and IDE extensions all run MCP tooling in contexts where an attacker with the ability to send crafted messages to the server has equivalent access to what a local user would have. The blast radius isn't limited to someone sitting at the terminal. More critically, two of the four affected functions — installSkill and uninstallSkill — imply write operations. A path traversal on a read-capable function is information disclosure. A path traversal on a write-capable function is config overwriting, cron manipulation, or authorized_keys insertion depending on the service's user context. That's not a 5.3. That's the difference between a leak and a foothold. Three remediation approaches are technically possible: canonicalizing paths (resolve and compare), rejecting traversal sequences explicitly, or scope-locking operations to a verified root directory. Only scope-locking —jailing all file operations to a confirmed workspace root— doesn't rely on anticipating every possible attack vector. Canonicalization alone can fail on symlinks. Traversal rejection is brittle. The patched version is 0.1.1, but verify what approach it actually takes; the difference matters for residual risk. One more thing: old npm versions don't disappear. 0.1.0 persists in CI caches, Docker layers built on pinned versions, and any fork that grabbed the package before this CVE dropped. If you're running this package anywhere, check your dependency tree now — don't assume 'upgraded' means 'gone.'

Reviewed through automated stages and approved by a human before publication.