Description

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path traversal. The attack is only possible with local access. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T00:16:47.010Z",
  "pubdate": "2026-08-09T00:16:47.010Z",
  "executiveSummary": "A path traversal vulnerability has been identified in azer react-analyzer-mcp up to commit 335f2a3585f265e2e88352b59b10d3b478d678b0. The vulnerability exists within the analyze-projec component, specifically inside the generateProjectDocs function located in src/index.ts. The flaw arises from the insecure handling of the projectName argument, allowing unauthorized manipulation of file system paths.\nThe primary impact of this vulnerability is unauthorized access to arbitrary files on the underlying host system, bounded only by the privileges of the executing process. Successful exploitation requires local access to the system, meaning an attacker must already possess a local execution context or the ability to interact directly with the affected component locally.\nBecause the product utilizes a rolling release model, explicit version numbers for affected releases are unavailable, necessitating reliance on commit hashes for identification. The project maintainers were notified via an early issue report but have not yet provided a response or an official patch.\nThe risk implication is moderate to high depending on the privilege level of the user executing the analyzer, as malicious local actors could potentially read sensitive system files or write to unauthorized directories through directory traversal sequences.",
  "technicalDetails": "The vulnerability resides in the src/index.ts file of the analyze-projec component, specifically within the generateProjectDocs function. The root cause of the security flaw is insufficient input sanitization and validation of the projectName argument before it is utilized in file system operations.\nWhen a user or calling process supplies a malicious payload containing path traversal sequences (such as directory navigation sequences like ../) via the projectName argument, the application fails to adequately neutralize these inputs. Consequently, the underlying file system APIs resolve the path relative to the intended base directory, allowing traversal outside the designated project boundary.\nThe attack flow proceeds as follows: First, the attacker invokes the analyze-projec component or interacts directly with the generateProjectDocs function. Second, the attacker injects specially crafted traversal patterns into the projectName parameter. Third, the application concatenates this unsanitized input into file system path constructions. Finally, the operating system executes read or write operations outside the intended scope, determined by the access rights of the process running react-analyzer-mcp.\nRegarding execution constraints, network exposure is not required as the attack vector is strictly restricted to local access. Authentication requirements depend on the local environment in which the tool is executed, and privilege requirements are dictated by the operating system permissions assigned to the user running the affected Node.js process. The post-exploitation impact includes unauthorized local file disclosure or manipulation, depending on how the generated paths are utilized by the file system methods within generateProjectDocs."
}