Description

A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component insert_creds_range_config. Executing a manipulation of the argument configPath/outputPath can lead to path traversal. The attack is restricted to local execution. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T19:17:01.147Z",
  "pubdate": "2026-08-09T19:17:01.147Z",
  "executiveSummary": "A path traversal vulnerability has been identified in NocteDefensor LudusMCP up to version 1.0.24, specifically within the insert_creds_range_config component.\nThe vulnerability resides in the src/tools/insertCredsRangeConfig.ts file, where improper handling of input arguments allows for unauthorized manipulation of file system paths.\nAn attacker capable of local execution can supply crafted input via the configPath or outputPath arguments to traverse the directory structure and potentially read or write files outside the intended operational scope.\nThe primary impact involves unauthorized file system access, which depends heavily on the privileges of the local user executing the application.\nThe project maintainers were notified via an issue report but have not yet provided an official response or patch.\nMitigation requires strict input validation and sanitization of path parameters within the affected TypeScript component.",
  "technicalDetails": "The vulnerability is classified as a path traversal flaw, stemming from the insecure processing of file path parameters within the insert_creds_range_config component of NocteDefensor LudusMCP up to version 1.0.24.\nThe root cause is located in the src/tools/insertCredsRangeConfig.ts file, where the application accepts user-controlled input via the configPath or outputPath arguments without sufficient validation, canonicalization, or sanitization.\nAttack execution is restricted to local execution, requiring the adversary to have local access to the system running the vulnerable software or the ability to influence the arguments passed to the tool.\nDuring the attack flow, a local user or an adversary with local execution privileges supplies input containing directory traversal sequences (such as dot-dot-slash patterns) within the vulnerable parameters.\nWhen the application attempts to resolve or perform file operations using the unsanitized configPath or outputPath values, the operating system evaluates the traversal sequences, allowing access to files and directories outside the designated working directory.\nDepending on whether the manipulated parameter governs read or write operations, this flaw can lead to arbitrary file read or arbitrary file write scenarios constrained only by the access permissions of the running process.\nNetwork exposure is not a direct vector based on the available description, as the attack is strictly confined to local execution prerequisites.\nAuthentication and privilege requirements align with local execution access levels needed to invoke the vulnerable function within the LudusMCP environment."
}