Description

A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed locally. Upgrading to version 0.1.1 is recommended to address this issue. The identifier of the patch is 855b46739e0f6e8388f17f9d0066ac4298a3965d. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T03:16:57.243Z",
  "pubdate": "2026-08-09T03:16:57.243Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the aktsmm skill-ninja-mcp-server product, specifically within version 0.1.0.\nThe vulnerability resides in the workspacePath argument processed by multiple functions within the src/installer.ts file.\nSuccessful exploitation of this flaw allows an attacker with local access to manipulate file system paths, potentially leading to unauthorized file read or write operations outside the intended working directory.\nThe risk implication involves compromise of local file integrity and confidentiality depending on the privileges of the executing process.\nThe attack must be executed locally against the affected system.\nMitigation requires upgrading the affected component to version 0.1.1, which applies the official patch identified as 855b46739e0f6e8388f17f9d0066ac4298a3965d.",
  "technicalDetails": "The vulnerability is classified as a path traversal flaw caused by insufficient input validation and sanitization of user-supplied parameters.\nThe vulnerable component is the src/installer.ts file within version 0.1.0 of aktsmm skill-ninja-mcp-server.\nSpecifically, the functions getInstalledSkills, installSkill, updateAgentsMd, and uninstallSkill process the workspacePath argument insecurely.\nWhen an attacker supplies a manipulated workspacePath argument containing directory traversal sequences such as dot-dot-slash (../), the application fails to properly restrict file system operations to the designated base directory.\nThe attack flow requires local execution capabilities, where the attacker invokes the affected functions with crafted path traversal payloads.\nDue to the lack of robust path normalization or canonicalization checks prior to executing file system interactions, the underlying file operations are performed against unintended directories.\nDepending on the specific function invoked, this behavior can result in skills being installed, uninstalled, or configuration files such as agents.md being modified or read outside the intended workspace boundaries.\nAuthentication and privilege requirements are dictated by the local environment context in which the MCP server executes, but the attack fundamentally relies on local access to supply the malicious workspacePath argument.\nPost-exploitation impact includes unauthorized file manipulation, potential disclosure of sensitive local data, or corruption of critical application files residing on the host system."
}