CVE-2026-15528
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability was found in kicad-mcp up to version 3.3.1 in the file kicad_mcp/utils/path_validator.py. Manipulation of the project_path or schematic_path arguments leads to protection mechanism failure. Local access is required and the exploit has been made public.
Risk Assessment
The organization is at risk of local attacks that could lead to unauthorized file access or privilege escalation on systems using the vulnerable library version.
Recommendation
Immediately update kicad-mcp to a version above 3.3.1 if available, or apply a temporary workaround by restricting access to the path_validator.py file.
Original NVD description (English source)
A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicad_mcp/utils/path_validator.py. Performing a manipulation of the argument project_path/schematic_path results in protection mechanism failure. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.