Description

A security vulnerability has been detected in MonomythDevelopment la-forge-mcp 1.0.0. This issue affects the function screenshotElement of the file src/index.ts of the component screenshot_element Tool. Such manipulation of the argument output_name leads to path traversal. The attack can be executed remotely. Upgrading to version 1.1.1 is capable of addressing this issue. The name of the patch is 1102172c9adec4a619e241efd6bfb74f5b1f4332. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-06T13:17:27.803Z",
  "pubdate": "2026-08-06T13:17:27.803Z",
  "executiveSummary": "A path traversal vulnerability has been identified in MonomythDevelopment la-forge-mcp version 1.0.0, specifically within the screenshotElement function located in src/index.ts of the screenshot_element Tool component. This security flaw enables remote attackers to manipulate the output_name argument, potentially leading to unauthorized file system access or arbitrary file write operations outside the intended target directory. The vulnerability poses significant risk to the integrity and confidentiality of the host system. Exploitation can be executed remotely without prior authentication if network exposure permits interaction with the affected component. The vendor has been responsive and released a security update in version 1.1.1 to resolve the issue.",
  "technicalDetails": "The vulnerability resides in the screenshotElement function within the src/index.ts file of the screenshot_element Tool component in MonomythDevelopment la-forge-mcp version 1.0.0. The root cause of the issue stems from insufficient input validation and sanitization of the output_name argument supplied by the user during the screenshot capture process. Because the application fails to properly sanitize directory traversal sequences such as dot-dot-slash (../) from the user-supplied filename parameter, an attacker can craft malicious inputs that traverse the directory tree.\nDuring a typical attack flow, a remote adversary interacts with the screenshot_element Tool component over the network. The attacker supplies a crafted payload containing path traversal sequences within the output_name argument. When the vulnerable screenshotElement function processes this unsanitized input to store the generated screenshot, the underlying file system operations resolve the path relative to the intended base directory, allowing the file to be written to arbitrary locations on the file system where the application process possesses write permissions.\nThe execution of this attack requires network exposure to the vulnerable component and does not rely on complex authentication mechanisms or elevated privileges beyond what the application process itself holds. Depending on the file write permissions of the running process, successful exploitation can result in the overwriting of critical system or application files, potentially leading to denial of service or further compromise of the host environment. The vulnerability is fully resolved in version 1.1.1 through the implementation of proper input sanitization and path validation controls introduced via patch identifier 1102172c9adec4a619e241efd6bfb74f5b1f4332."
}