CVE-2026-15526
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A path traversal vulnerability has been found in the augmnt augments-mcp-server version 7.1.0 in the scanProjectDeps function of the file src/tools/v4/scan-project-deps.ts. The attack requires local access and manipulation of the packageJsonPath argument. The exploit has been published and the project has not responded to the report.
Risk Assessment
The risk involves potential arbitrary file read by a local attacker, which could lead to sensitive data leakage or further privilege escalation.
Recommendation
It is recommended to immediately disable or restrict access to the scan_project_deps component until a patch is released. Also monitor local user accounts for unauthorized activities.
Original NVD description (English source)
A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file src/tools/v4/scan-project-deps.ts of the component scan_project_deps. Executing a manipulation of the argument packageJsonPath can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.