CVE-2026-19368
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A vulnerability in PV-Bhat gemsuite-mcp 1.0.0 affects some unknown functionality in src/handlers/unified-gemini.ts of the gemini_search/gemini_reason/gemini_process/gemini_analyze component. Manipulation of the argument file_path/file_paths results in path traversal. The attack must be initiated from a local position. The project was informed but has not responded.
Risk Assessment
An attacker with local access can read arbitrary files on the server, potentially leading to exposure of sensitive data or further system compromise.
Recommendation
Apply vendor patches if available. Restrict local access to the application and validate file paths to prevent path traversal.
Original NVD description (English source)
A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the file src/handlers/unified-gemini.ts of the component gemini_search/gemini_reason/gemini_process/gemini_analyze. The manipulation of the argument file_path/file_paths results in path traversal. The attack must be initiated from a local position. The project was informed of the problem early through an issue report but has not responded yet.